.NET Development Foundation/Security

Security Security Security Exam objective: Improving the security of the .NET Framework applications by using the .NET Framework 2.0 security features Topics Code access security Code access security Code access security, CAS, allows the control of various permissions granted to specific managed applications. MSDN Permissions allow access to system resources. A permission set is a collection of permissions. A code group relates exactly one permission set to exactly one evidence type. Evidence is used to identify an assembly. Evidence types can include the application directory, cryptographic hash of the assembly, publisher's digital signature, site from which the assembly was downloaded, cryptographic strong name of the assembly, URL from which the assembly was downloaded, and the security zone in which the assembly is running. Security zones include the computer zone, local Intranet zone, Internet zone, trusted site, and untrusted sites. See the Internet options security tab in Internet Explorer to view various security zones. An assembly can be associated with multiple code groups. Permission sets can be associated with multiple code groups. A security policy is a logical grouping of code groups and permission sets. An untrusted managed assembly must pass through four security policies: The Enterprise security policy, machine security policy, user security policy, and application domain security policy. Any one of these security policies can deny an untrusted managed assembly permissions. Classes, interfaces, and tools Implement code access security Exam objective: Implement code access security to improve the security of a .NET Framework application. (Refer System.Security namespace) SecurityManager class - MSDN CodeAccessPermission class - MSDN Modify the Code Access security policy at the machine, user, and enterprise policy level by using the Code Access Security Policy tool (Caspol.exe) - MSDN PermissionSet class, NamedPermissionSet class, and PermissionSetCollection class PermissionSet class - MSDN NamedPermissionSet class - MSDN PermissionSetCollection class There does not seem to be such a thing, to be investigated... Standard Security interfaces IEvidenceFactory interface - MSDN IPermission interface - MSDN Implement access control Exam objective: Implement access control by using the System.Security.AccessControl classes. DirectorySecurity class, FileSecurity class, FileSystemSecurity class, and RegistrySecurity class DirectorySecurity class - MSDN FileSecurity class - MSDN FileSystemSecurity class - MSDN RegistrySecurity class - MSDN AccessRule class - MSDN AuthorizationRule class and AuthorizationRuleCollection class AuthorizationRule class - MSDN AuthorizationRuleCollection class - MSDN CommonAce class, CommonAcl class, CompoundAce class, GenericAce class, and GenericAcl class CommonAce class - MSDN CommonAcl class - MSDN CompoundAce class - MSDN GenericAce class - MSDN GenericAcl class - MSDN AuditRule class - MSDN MutexSecurity class, ObjectSecurity class, and SemaphoreSecurity class MutexSecurity class - MSDN ObjectSecurity class - MSDN SemaphoreSecurity class - MSDN Implement custom authentication scheme Exam objective: Implement a custom authentication scheme by using the System.Security.Authentication classes. (Refer System.Security.Authentication namespace - MSDN) For a reference on custom authentification schemes see MSDN Encrypt, decrypt and hash data Exam objective: Encrypt, decrypt, and hash data by using the System.Security.Cryptography classes. (Refer System.Security.Cryptography namespace) DES class and DESCryptoServiceProvider class DES class - MSDN DESCryptoServiceProvider class - MSDN HashAlgorithm class - MSDN DSA class and DSACryptoServiceProvider class DSA class - MSDN DSACryptoServiceProvider class - MSDN SHA1 class and SHA1CryptoServiceProvider class SHA1 class - MSDN SHA1CryptoServiceProvider class - MSDN TripleDES and TripleDESCryptoServiceProvider class TripleDES - MSDN TripleDESCryptoServiceProvider class - MSDN MD5 class and MD5CryptoServiceProvider class MD5 class - MSDN MD5CryptoServiceProvider class - MSDN RSA class and RSACryptoServiceProvider class RSA class - MSDN RSACryptoServiceProvider class - MSDN RandomNumberGenerator class - MSDN CryptoStream class - MSDN CryptoConfig class - MSDN RC2 class and RC2CryptoServiceProvider class RC2 class - MSDN RC2CryptoServiceProvider class - MSDN AssymetricAlgorithm class MSDN ProtectedData class and ProtectedMemory class ProtectedData class - MSDN ProtectedMemory class - MSDN RijndaelManaged class and RijndaelManagedTransform class RijndaelManaged class - MSDN RijndaelManagedTransform class - MSDN CspParameters class - MSDN CryptoAPITransform class - MSDN Hash-based Message Authentication Code (HMAC) - MSDN HMACMD5 class - MSDN HMACRIPEMD160 class - MSDN HMACSHA1 class - MSDN HMACSHA256 class - MSDN HMACSHA384 class - MSDN HMACSHA512 class - MSDN Control permissions Exam objective: Control permissions for resources by using the System.Security.Permission classes. (Refer System.Security.Permission namespace) SecurityPermission class - MSDN PrincipalPermission class - MSDN FileIOPermission class - MSDN You can also set the FileIoPermisson attribute at assembly level or class level. Be then aware about the SecurityAction enumerations: SecurityAction.RequestRefuse: specifies the operations that should not be granted. SecurityAction.RequestMinumum: request for a minimum set of permissions. If not given, the app will not execute. StrongNameIdentityPermission class - MSDN UIPermission class - MSDN UrlIdentityPermission class - MSDN PublisherIdentityPermission class - MSDN GacIdentityPermission class - MSDN FileDialogPermission class - MSDN DataProtectionPermission class - MSDN EnvironmentPermission class - MSDN IUnrestrictedPermission interface - MSDN RegistryPermission class - MSDN IsolatedStorageFilePermission class - MSDN KeyContainerPermission class - MSDN ReflectionPermission class - MSDN StorePermission class - MSDN SiteIdentityPermission class - MSDN ZoneIdentityPermission class - MSDN Control code privileges Exam objective: Control code privileges by using System.Security.Policy classes. (Refer System.Security.Policy namespace) ApplicationSecurityInfo class and ApplicationSecurityManager class ApplicationSecurityInfo class - MSDN ApplicationSecurityManager class - MSDN ApplicationTrust class and ApplicationTrustCollection class ApplicationTrust class - MSDN ApplicationTrustCollection class - MSDN Evidence class and PermissionRequestEvidence class Evidence class - MSDN PermissionRequestEvidence class - MSDN CodeGroup class, FileCodeGroup class, FirstMatchCodeGroup class, NetCodeGroup class, and UnionCodeGroup class CodeGroup class - MSDN FileCodeGroup class - MSDN FirstMatchCodeGroup class - MSDN NetCodeGroup class - MSDN UnionCodeGroup class - MSDN Condition classes AllMembershipCondition class - MSDN ApplicationDirectory class and ApplicationDirectoryMembershipCondition class ApplicationDirectory class - MSDN ApplicationDirectoryMembershipCondition class - MSDN GacMembership class and GacMembershipCondition class GacMembership class No search results on MSDN!? a little investigation required here. GacMembershipCondition class - MSDN Hash class and HashMembershipCondition class Hash class - MSDN HashMembershipCondition class - MSDN Publisher class and PublisherMembershipCondition class Publisher class - MSDN PublisherMembershipCondition class - MSDN Site class and SiteMembershipCondition class Site class - MSDN SiteMembershipCondition class - MSDN StrongName class and StrongNameMembershipCondition class StrongName class - MSDN StrongNameMembershipCondition class - MSDN Url class and UrlMembershipConditon class Url class - MSDN UrlMembershipConditon class - MSDN Zone class and ZoneMembershipCondition class Zone class - MSDN ZoneMembershipCondition class - MSDN PolicyLevel class and PolicyStatement class PolicyLevel class - MSDN PolicyStatement class - MSDN IApplicationTrustManager interface, IMembershipCondition interface, and IIdentityPermissionFactory interface IApplicationTrustManager interface - MSDN IMembershipCondition interface - MSDN IIdentityPermissionFactory interface - MSDN Access and modify identity information Exam objective: Access and modify identity information by using the System.Security.Principal classes. (Refer System.Security.Principal namespace) GenericIdentity class and GenericPrincipal class GenericIdentity class - MSDN GenericPrincipal class - MSDN WindowsIdentity class and WindowsPrincipal class WindowsIdentity class - MSDN WindowsPrincipal class - MSDN NTAccount class and SecurityIdentifier class NTAccount class - MSDN SecurityIdentifier class - MSDN IIdentity interface and IPrincipal interface IIdentity interface - MSDN IPrincipal interface - MSDN WindowsImpersonationContext class - MSDN IdentityReference class and IdentityReferenceCollection class IdentityReference class - MSDN IdentityReferenceCollection class - MSDN Previous / Next