Cloud Application Security in C# for Azure (CASEC-CAZ)

DAY 1

Cyber security basics

• What is security?
• Threat and risk
• Cyber security threat types
• Consequences of insecure software
  • Constraints and the market
  • The dark side
• Cloud security basics
  • Cloud infrastructure basics
  • Cloud architectures and security
  • The Cloud Cube Model
  • Attack surface in the cloud
• Cloud data security
  • Data confidentiality and integrity in the cloud
  • Data privacy in the cloud
  • Compliance considerations
• Cloud deployment security
  • Hardening cloud deployments
  • Security of jump boxes
  • Serverless computing and security
• Cloud security standards and best practices
  • SOC compliance
  • CSA controls
  • Other standards

The OWASP Top Ten

• OWASP Top 10 – 2017
• A1 - Injection
  • Injection principles
  • Injection attacks
  • SQL injection
    • SQL injection basics
    • Lab – SQL injection
    • Attack techniques
    • Content-based blind SQL injection
    • Time-based blind SQL injection
  • NoSQL injection
    • NoSQL injection specialties
    • NoSQL injection in MongoDB
    • NoSQL injection in CosmosDB
  • SQL injection best practices
    • Input validation
    • Parameterized queries
    • Lab – Using prepared statements
    • Additional considerations
    • Case study – Hacking Fortnite accounts
    • SQL injection protection and ORM
  • Parameter manipulation
    • CRLF injection
      • Log forging
      • Log forging – best practices
      • HTTP response splitting
      • Header checking in ASP.NET
    • HTTP parameter manipulation
      • HTTP parameter pollution
      • Variable shadowing
      • Value shadowing
  • Code injection
    • OS command injection
      • Lab – Command injection
      • OS command injection best practices
      • Avoiding command injection with the right APIs
      • Lab – Command injection best practices
      • Case study – Command injection via ping
  • Script injection
  • Dangerous file inclusion

DAY 2

The OWASP Top Ten

• A2 - Broken Authentication
  • Authentication
    • Authentication basics
    • Multi-factor authentication
    • Multi-factor authentication best practices
    • Authentication weaknesses - spoofing
    • Spoofing on the Web
    • Case study – PayPal 2FA bypass
    • User interface best practices
• Single sign-on (SSO)
  • Single sign-on concept
  • OAuth2
    • OAuth2 basics
    • OAuth2 in practice
    • Best practices
    • Configuration best practices
    • Case study – Stealing SSO tokens from Epic Games accounts
  • SAML
    • SAML basics
    • SAML profiles
    • SAML security
• Password management
  • Inbound password management
    • Storing account passwords
    • Password in transit
    • Lab – Is just hashing passwords enough?
    • Dictionary attacks and brute forcing
    • Salting
    • Adaptive hash functions for password storage
    • Lab – Using adaptive hash functions in C#
    • Password policy
    • NIST authenticator requirements for memorized secrets
    • Password hardening
    • Using passphrases
    • Password change
    • Password recovery issues
    • Password recovery best practices
    • Lab – Password reset weakness
    • Case study – The Ashley Madison data breach
    • The dictionary attack
    • The ultimate crack
    • Exploitation and the lessons learned
    • Password database migration
    • (Mis)handling null passwords
  • Outbound password management
    • Hard coded passwords
    • Best practices
    • Lab – Hardcoded password
    • Protecting sensitive information in memory
    • Challenges in protecting memory
    • Storing sensitive data in memory
    • Lab – Using secret-handling classes in C#
• Session management
  • Session management essentials
  • Why do we protect session IDs – Session hijacking
  • Session fixation
  • Session invalidation
  • Session ID best practices
  • Cross-site Request Forgery (CSRF)
    • Lab – Cross-site Request Forgery
    • CSRF best practices
    • CSRF defense in depth
    • Lab – CSRF protection with tokens
  • Cookie security
    • Cookie security best practices
    • Cookie attributes
• A3 - Sensitive Data Exposure
  • Information exposure
  • Exposure through extracted data and aggregation
  • Case study – Strava data exposure
  • System information leakage
    • Leaking system information
  • Information exposure best practices
• A4 - XML External Entities (XXE)
  • DTD and the entities
  • Entity expansion
  • External Entity Attack (XXE)
    • File inclusion with external entities
    • Server-Side Request Forgery with external entities
    • Lab – External entity attack
    • Case study – XXE vulnerability in SAP Store
    • Preventing XXE
    • Lab – Prohibiting DTD

DAY 3

The OWASP Top Ten

• A5 - Broken Access Control
  • Access control basics
  • Failure to restrict URL access
  • Confused deputy
    • Insecure direct object reference (IDOR)
    • Lab – Insecure Direct Object Reference
    • Case study – Authorization bypass on Facebook
    • Authorization bypass through user-controlled keys
    • Lab – Horizontal authorization
  • File upload
    • Unrestricted file upload
    • Good practices
    • Lab – Unrestricted file upload
• A7 - Cross-site Scripting (XSS)
  • Cross-site scripting basics
  • Cross-site scripting types
    • Persistent cross-site scripting
    • Reflected cross-site scripting
    • Client-side (DOM-based) cross-site scripting
    • Lab – Stored XSS
    • Lab – Reflected XSS
    • Case study – XSS in Fortnite accounts
  • XSS protection best practices
    • Protection principles - escaping
    • XSS protection APIs
    • Request validation in ASP.NET
    • Further XSS protection techniques
    • Lab – XSS fix / stored
    • Lab – XSS fix / reflected
    • Additional protection layers
    • Client-side protection principles
• A8 - Insecure Deserialization
  • Serialization and deserialization challenges
  • Integrity – deserializing untrusted streams
  • Integrity – deserialization best practices
  • Property Oriented Programming (POP)
    • Creating payload
    • Summary – POP best practices
    • Lab – Creating a POP payload
    • Lab – Using the POP payload
• A9 - Using Components with Known Vulnerabilities
  • Using vulnerable components
  • Assessing the environment
  • Hardening
  • Untrusted functionality import
  • Importing JavaScript
  • Lab – Importing JavaScript
  • Case study – The British Airways data breach
  • Vulnerability management
    • Patch management
    • Vulnerability management
    • Bug bounty programs
    • Vulnerability databases
    • Vulnerability rating – CVSS
    • Lab – Finding vulnerabilities in third-party components
    • DevOps, the build process and CI / CD
    • Dependency checking in C#
    • Lab – Detecting vulnerable components
• A10 - Insufficient Logging & Monitoring
  • Logging and monitoring principles
  • Insufficient logging
  • Case study – Plaintext passwords at Facebook
  • Logging best practices
  • Monitoring best practices

Web application security beyond the Top Ten

• Client-side security
• Same Origin Policy
• Tabnabbing
• Lab – Reverse tabnabbing
• Frame sandboxing
  • Cross-Frame Scripting (XFS) attack
  • Lab - Clickjacking
  • Clickjacking beyond hijacking a click
  • Clickjacking protection best practices
  • Lab – Using CSP to prevent clickjacking

DAY 4

Cloud infrastructure security

• Container security
  • Container security concerns
  • Containerization, virtualization, and security
  • Attack surface of container technologies
  • Container security tools
  • Docker security
    • Docker and security
    • Docker security features
    • Common Docker security mistakes
    • Docker security best practices
    • Hardening Docker
    • Lab – Static analysis of Docker image
  • Kubernetes security
    • The Kubernetes architecture and security
    • Common Kubernetes security mistakes
    • Securing Kubernetes hosts
    • Best practices for Kubernetes access control
    • Building secure Kubernetes images
    • Secure deployment of Kubernetes containers
    • Protecting Kubernetes deployments at runtime
    • Lab – Scanning a Kubernetes image for vulnerabilities
• Azure security
  • Security considerations for Azure
    • Azure and security
    • Azure security features
    • The Azure shared responsibility model
    • Azure cloud compliance
    • Azure hardening
    • Security tools for Azure
  • Identity and access management (IAM)
    • Identity and access management in Azure
    • Azure Active Directory
    • Multi-factor authentication with Azure
    • Azure RBAC
    • Azure Active Directory Federation Services
    • Azure Shared Access Signatures (SAS)
  • Data security
    • Data security in Azure
    • Storing cryptographic keys in Azure
    • Protecting data in transit
    • Protecting data at rest
  • Detection and monitoring
    • Utilizing Azure monitoring for security
    • The Azure Application Gateway WAF
    • The Azure Security Center

API security

• Input validation
  • Input validation principles
  • Blacklists and whitelists
  • Data validation techniques
  • Lab – Input validation
  • What to validate – the attack surface
  • Where to validate – defense in depth
  • When to validate – validation vs transformations
  • Output sanitization
  • Encoding challenges
  • Unicode challenges
  • Lab – Encoding challenges
  • Validation with regex
• Integer handling problems
  • Representing signed numbers
  • Integer visualization
  • Integer overflow
  • Lab – Integer overflow
  • Signed / unsigned confusion
  • Case study – The Stockholm Stock Exchange
  • Lab – Signed / unsigned confusion
  • Integer truncation
  • Best practices
    • Upcasting
    • Precondition testing
    • Postcondition testing
    • Using big integer libraries
    • Integer handling in C#
    • Lab – Checked arithmetics

JSON security

• JSON validation
• JSON injection
• Dangers of JSONP
• JSON/JavaScript hijacking
• Best practices
• Case study – ReactJS vulnerability in HackerOne

DAY 5

API security

• Input validation
  • Files and streams
    • Path traversal
    • Lab – Path traversal
    • Path traversal-related examples
    • Additional challenges in Windows
    • Virtual resources
    • Path traversal best practices
    • Lab – Path canonicalization
  • Unsafe reflection
    • Reflection without validation
    • Lab – Unsafe reflection

XML security

• XML validation
• XML injection
  • XPath injection
  • Blind XPath injection

Denial of service

• Denial of Service
• Flooding
• Resource exhaustion
• Sustained client engagement
• Denial of service problems in C#
• Infinite loop
• Economic Denial of Sustainability (EDoS)
• Algorithm complexity issues
  • Regular expression denial of service (ReDoS)
    • Lab – ReDoS in C#
    • Dealing with ReDoS
    • Hash table collision
      • How do hash tables work?
      • Hash collision in case of hash tables

Cryptography for developers

• Cryptography basics
• Crypto APIs in C#
• Elementary algorithms
  • Hashing
    • Hashing basics
    • Hashing in C#
    • Lab – Hashing in C#
• Confidentiality protection
  • Symmetric encryption
    • Block ciphers
    • Modes of operation
    • Modes of operation and IV – best practices
    • Symmetric encryption in C#
    • Symmetric encryption in C# with streams
    • ProtectedData and ProtectedMemory
    • Lab – Symmetric encryption in in C#
  • Asymmetric encryption
  • Combining symmetric and asymmetric algorithms
• Integrity protection
  • Message Authentication Code (MAC)
    • Calculating HMAC in C#
    • Lab – Calculating MAC in C#
  • Digital signature
    • Lab – Digital signature with ECDSA in C#
• Public Key Infrastructure (PKI)
  • Some further key management challenges
  • Certificates
    • Certificate management – best practices
• Transport security
  • Transport security weaknesses
  • The TLS protocol
    • TLS basics
    • TLS features (changes in v1.3)
    • The handshake in a nutshell (v1.3)
    • TLS best practices
    • TLS authentication best practices
    • HTTP Strict Transport Security (HSTS)
    • Lab – Setting HSTS in C#

Wrap up

• Secure coding principles
  • Principles of robust programming by Matt Bishop
  • Secure design principles of Saltzer and Schröder
• And now what?
  • Software security sources and further reading
  • .NET and C# resources