'NET Security

1
.NET Security

• Tommy Johansen

2
Agenda

• Authentication
• Autorization
• Policies
• .NET Configuration
• ?

3
Authentication
4
Permission types
5
Permission types
6
(No Transcript)
7
Security Evidence

• Assembly
• All code Evidence
• Origin-based Evidence
• Content-based Evidence

8
Origin-based Evidence

• Application Directory evidence
• Same directory or child directory
• Site evidence
• http//www.somesite.com (Only toplevel)
• URL evidence
• http//www.somesite.com/asmfolder
• http//www.somesite.com/
• Zone evidence

9
Origin-based Evidence

• Zone Evidence
• The My Computer zone.
• The Local Intranet zone.
• The Internet zone.
• The Trusted Site zone.
• The untrusted Site zone.

10
Content-based Evidence

• Strong name
• Public key
• Name
• Version
• Publisher
• Signed with certificate (signcode.exe)
• Hash
• SHA1 or MD5

11
Code Groups and security policies

• A codegroup is binding of a single permission set
  with a particular evidence.
• A .NET security policy is a
• collection of code groups.

12
Code Groups
Code group
Permission set
Evidence
Permission A
Permission B
Permission C
13
Security policy
14
Combining policies
Policy A
Granted
Policy C
Policy B
15
Policy types

• Enterprice policy
• Machine policy
• User policy
• Application domain policy

16
Security model
Policies
Code groups
Permission sets
Evidence
Permissions
Content based evidence
Origin based evidence
17
.NET Configuration
18
(No Transcript)
19
Exsampel for security permission
20
Closing up

• Questions?