.NET Framework 2.0

Ever received a "Could not load file or assembly" ... "The system cannot find the file specified" on your ASP.NET web application

Murray Gordon — Thu, 25 Jan 2007 16:17:00 GMT

Well I did, and the issue seemed to be intermittent. Here’s what it looked like for me:

Here’s what I found out.

You can read about the issue on Microsoft’s Help and Support at FIX: You may receive an InvalidCastException error in an ASP.NET-connected Web application (http://support.microsoft.com/Default.aspx?kbid=915782)

Unfortunately, there’s no immediate download or fix. You have to call Microsoft Support to find out if the secret fix applies to your scenario.

In my case it did not. I have already received a fix pack taking me from .NET Framework 2.0.50727.80 to 2.0.50727.210, which meant they didn’t have a fix for me.

Fortunately my good buddy Bill Ryan, MVP and “Master of ADO.NET” had a recommendation:

Yah, I've gotten that a bunch actually. Usually it's b/c of temp files. Clear your temp directory and give it another try. What's happening is that the temp file name generated when the assembly is loaded exceed 255 characters. So it's truncated. That in turn means that what it's trying to access doesn't exist.

Here’s a related support kb addressing the issue: http://support.microsoft.com/kb/823196

Also, set the compilation directory's tempDirectory property specifically. You can point it to C:\whatever or some shorter path name than it normally would use and thereby not have the really long path name problem.

Needless to say, that worked for me.

Thanks Bill!

And to anyone out there having this problem, hope this helps.

Thanks,

Murray

How to: Include a Data File in a ClickOnce Application

Murray Gordon — Fri, 06 Oct 2006 00:44:00 GMT

How to: Include a Data File in a ClickOnce Application

How to: Include a Data File in a ClickOnce Application.

How to add Desktop Shortcut to ClickOnce Deployment Application

Murray Gordon — Thu, 05 Oct 2006 00:04:00 GMT

Here's a great post on how to add a desktop shortcut to ClickOnce Deployed Application. (Scott Schecter's post)
http://blog.scottschecter.net/TheZenOfTheClickOnceDeployedApplicationDesktopShortcut.aspx

Here's the version of this solution in VB. (Julia Lerman's post)
http://blog.ziffdavis.com/devlife/archive/2006/07/28/42695.aspx

If you don't want to follow the link, here's the code:

/// <summary>

/// This will create a Application Reference file on the users desktop

/// if they do not already have one when the program is loaded.

// If not debugging in visual studio check for Application Reference

// #if (!debug)

// CheckForShortcut();

// #endif

/// </summary

void CheckForShortcut()

{

ApplicationDeployment ad = ApplicationDeployment.CurrentDeployment;

if (ad.IsFirstRun)

{

Assembly code = Assembly.GetExecutingAssembly();

string company = string.Empty;

string description = string.Empty;

if (Attribute.IsDefined(code, typeof(AssemblyCompanyAttribute)))

{

AssemblyCompanyAttribute ascompany = (AssemblyCompanyAttribute)Attribute.GetCustomAttribute(code,

typeof(AssemblyCompanyAttribute));

company = ascompany.Company;

}

if (Attribute.IsDefined(code, typeof(AssemblyDescriptionAttribute)))

{

AssemblyDescriptionAttribute asdescription = (AssemblyDescriptionAttribute)Attribute.GetCustomAttribute(code,

typeof(AssemblyDescriptionAttribute));

description = asdescription.Description;

}

if (company != string.Empty && description != string.Empty)

{

string desktopPath = string.Empty;

desktopPath = string.Concat(Environment.GetFolderPath(Environment.SpecialFolder.Desktop),

"\\", description, ".appref-ms");

string shortcutName = string.Empty;

shortcutName = string.Concat(Environment.GetFolderPath(Environment.SpecialFolder.Programs),

"\\", company, "\\", description, ".appref-ms");

System.IO.File.Copy(shortcutName, desktopPath, true);

}

Hope it helps out.

Thanks,
Murray

Globalization & ClickOnce, ASP.NET Globalization

Murray Gordon — Wed, 04 Oct 2006 23:19:00 GMT

Great post from dasBlonde: http://www.dasblonde.net/PermaLink,guid,8d2a4b2c-c2f4-4dab-9bb6-b3218bf17c71.aspx

Here’s the details:

The blog is about globalization and how to architect Windows Forms and ASP.NET applications for localization, leveraging .NET resources where appropriate. Here’s the samples she listed:

Here’s the Additional globalization resources she listed:

She’s got some awesome content on ClickOnce. Check out the rest of her posts if you are looking for some great ClickOnce samples.

Here’s Microsoft recommendation on this subject (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspp/html/aspnet-globalarchi.asp?_r=1). The article is a bit dated, but the concepts are consistent.

FYI – there’s an interesting contrast to this approach I found on “The Code Project”. Very interesting approach http://www.codeproject.com/useritems/GlobalizationSample.asp?print=true

Thanks,
Murray

MSBUILD + MAGE.EXE = ClickOnce (Need some help... Experts welcome :-) )

Murray Gordon — Wed, 06 Sep 2006 13:36:00 GMT

If anyone has any experience with MSBUILD and Mage.exe to build ClickOnce projects, please let me know if you might be able to help.

I used Mike Bouck’s blog on ClickOnce as a guide. (great post Mike) http://blog.gatosoft.com/PermaLink,guid,d0a0dd1e-c9ac-4fa9-a408-615454d49702.aspx

I'm having a similar issue from this post in the Microsoft forums: http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=664144&SiteID=1

I'm using mage.exe as a part of an MSBuild project.

Here's the error I get when I try to run the application (the highlighted part contains my error summary – included as attachment also):

PLATFORM VERSION INFO
Windows : 5.1.2600.131072 (Win32NT)
Common Language Runtime : 2.0.50727.42
System.Deployment.dll : 2.0.50727.42 (RTM.050727-4200)
mscorwks.dll : 2.0.50727.42 (RTM.050727-4200)
dfdll.dll : 2.0.50727.42 (RTM.050727-4200)
dfshim.dll : 2.0.50727.42 (RTM.050727-4200)

SOURCES
Deployment url : http://localhost/Flicker.ClickOnce/local/ControlNET.application
Server : Microsoft-IIS/5.1
X-Powered-By : ASP.NET
Deployment Provider url : http://localhost/Flicker.ClickOnce/Local/ControlNET.application
Server : Microsoft-IIS/5.1
X-Powered-By : ASP.NET
Application url : http://localhost/Flicker.ClickOnce/Local/ControlNET.exe.manifest
Server : Microsoft-IIS/5.1
X-Powered-By : ASP.NET

IDENTITIES
Deployment Identity : ControlNET ClickOnce (Local).application, Version=2.2.244.2, Culture=neutral, PublicKeyToken=cd4d78a2e5181877, processorArchitecture=msil
Application Identity : ControlNET ClickOnce (Local).exe, Version=2.2.244.2, Culture=neutral, PublicKeyToken=cd4d78a2e5181877, processorArchitecture=msil, type=win32

APPLICATION SUMMARY
* Installable application.

ERROR SUMMARY
Below is a summary of the errors, details of these errors are listed later in the log.
* Activation of http://localhost/Flicker.ClickOnce/local/ControlNET.application resulted in exception. Following failure messages were detected:
+ Manifest XML signature is not valid.
+ No signature was present in the subject.

COMPONENT STORE TRANSACTION FAILURE SUMMARY
No transaction error was detected.

WARNINGS
There were no warnings during this operation.

OPERATION PROGRESS STATUS
* [9/1/2006 6:01:32 PM] : Activation of http://localhost/Flicker.ClickOnce/local/ControlNET.application has started.
* [9/1/2006 6:01:33 PM] : Processing of deployment manifest has successfully completed.
* [9/1/2006 6:01:33 PM] : Installation of the application has started.
* [9/1/2006 6:01:33 PM] : Processing of application manifest has successfully completed.
* [9/1/2006 6:01:36 PM] : Request of trust and detection of platform is complete.

ERROR DETAILS
Following errors were detected during this operation.
* [9/1/2006 6:01:43 PM] System.Deployment.Application.InvalidDeploymentException (SignatureValidation)
- Manifest XML signature is not valid.
- Source: System.Deployment
- Stack trace:
at System.Deployment.Application.Manifest.AssemblyManifest.ValidateSignature(Stream s)
at System.Deployment.Application.ComponentVerifier.VerifyStrongNameAssembly(String filePath, AssemblyManifest assemblyManifest)
at System.Deployment.Application.ComponentVerifier.StrongNameAssemblyComponent.Verify()
at System.Deployment.Application.ComponentVerifier.VerifyComponents()
at System.Deployment.Application.DownloadManager.DownloadDependencies(SubscriptionState subState, AssemblyManifest deployManifest, AssemblyManifest appManifest, Uri sourceUriBase, String targetDirectory, String group, IDownloadNotification notification, DownloadOptions options)
at System.Deployment.Application.ApplicationActivator.DownloadApplication(SubscriptionState subState, ActivationDescription actDesc, Int64 transactionId, TempDirectory& downloadTemp)
at System.Deployment.Application.ApplicationActivator.InstallApplication(SubscriptionState subState, ActivationDescription actDesc)
at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut)
at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)
--- Inner Exception ---
System.Security.Cryptography.CryptographicException
- No signature was present in the subject.

- Source: System.Deployment
- Stack trace:
at System.Deployment.Internal.CodeSigning.SignedCmiManifest.Verify(CmiManifestVerifyFlags verifyFlags)
at System.Deployment.Application.Manifest.AssemblyManifest.ValidateSignature(Stream s)

COMPONENT STORE TRANSACTION DETAILS
No transaction information is available.

Here's what my MSBuild project looks like (I highlighted my MAGE executes and the GenerateManifests... Can't figure out what might be wrong) Also included as attachment:

<?xml version="1.0" encoding="utf-8"?>

<Configuration Condition="'$(Environment)' == ''">Local</Configuration>

<PublishDir>Publish</PublishDir>

<SolutionName>ControlNET</SolutionName>

<SupportUrl>http://tempuri.org</SupportUrl>

<SigningCert>CambarCodeSigning.pfx</SigningCert>

<SigningCertPassword>cambar</SigningCertPassword>

<Company>Cambar Solutions</Company>

</PropertyGroup>

<SourceDir>bin\Debug</SourceDir>

<ConfigDir>Config\Local</ConfigDir>

<ClickOnceVirtualRootDir>Flicker.ClickOnce\Local</ClickOnceVirtualRootDir>

<ClickOnceUrl>http://localhost/Flicker.ClickOnce/Local/</ClickOnceUrl>

<ClickOnceApplicationUrl>$(ClickOnceUrl)$(SolutionName).application</ClickOnceApplicationUrl>

<ClickOnceAppTitle>ControlNET ClickOnce (Local)</ClickOnceAppTitle>

</PropertyGroup>

</When>

<SourceDir>bin\Debug</SourceDir>

<ConfigDir>Config\Dev</ConfigDir>

<ClickOnceVirtualRootDir>Flicker.ClickOnce\Dev</ClickOnceVirtualRootDir>

<ClickOnceUrl>http://localhost/Flicker.ClickOnce/Dev/</ClickOnceUrl>

<ClickOnceApplicationUrl>$(ClickOnceUrl)$(SolutionName).application</ClickOnceApplicationUrl>

<ClickOnceAppTitle>ControlNET ClickOnce (Dev)</ClickOnceAppTitle>

</PropertyGroup>

</When>

<SourceDir>bin\Release</SourceDir>

<ConfigDir>Config\Test</ConfigDir>

<ClickOnceVirtualRootDir>Flicker.ClickOnce\Test</ClickOnceVirtualRootDir>

<ClickOnceUrl>http://localhost/Flicker.ClickOnce/Test/</ClickOnceUrl>

<ClickOnceApplicationUrl>$(ClickOnceUrl)$(SolutionName).application</ClickOnceApplicationUrl>

<ClickOnceAppTitle>ControlNET ClickOnce (Test)</ClickOnceAppTitle>

</PropertyGroup>

</When>

<SourceDir>bin\Release</SourceDir>

<ConfigDir>Config\Prod</ConfigDir>

<ClickOnceVirtualRootDir>Flicker.ClickOnce\Prod</ClickOnceVirtualRootDir>

<ClickOnceUrl>http://localhost/Flicker.ClickOnce/Prod/</ClickOnceUrl>

<ClickOnceApplicationUrl>$(ClickOnceUrl)$(SolutionName).application</ClickOnceApplicationUrl>

<ClickOnceAppTitle>ControlNET ClickOnce</ClickOnceAppTitle>

</PropertyGroup>

</When>

</Choose>

</ItemGroup>

</ItemGroup>

</ItemGroup>

</ItemGroup>

<ProductName>.NET Framework 2.0</ProductName>

</BootstrapperFile>

</ItemGroup>

</ItemGroup>

<Output TaskParameter="Assemblies"

ItemName="GetVersionAssemblyInfo"/>

</GetAssemblyIdentity>

</Target>

<Copy SourceFiles="@(SourceFiles)"

DestinationFiles="@(SourceFiles->'$(PublishDir)\%(RecursiveDir)%(Filename)%(Extension)')"/>

<Copy SourceFiles="@(AppConfigFile)"

DestinationFiles="$(PublishDir)\$(SolutionName).exe.config"/>

<Copy SourceFiles="@(ClickOnceLandingPage)"

DestinationFiles="default.htm"/>

</Target>

</CreateItem>

<ModifyFile

Path="default.htm"

RegularExpression="#APPLICATION_NAME#"

NewValue="$(SolutionName)"

Force="true"/>

<ModifyFile

Path="default.htm"

RegularExpression="#TITLE#"

NewValue="$(ClickOnceAppTitle)"

Force="true"/>

<ModifyFile

Path="default.htm"

RegularExpression="#VERSION#"

NewValue="%(GetVersionAssemblyInfo.Version)"

Force="true"/>

<ModifyFile

Path="default.htm"

RegularExpression="#COMPANY#"

NewValue="$(Company)"

Force="true"/>

<ModifyFile

Path="default.htm"

RegularExpression="#SUPPORT_URL#"

NewValue="$(SupportUrl)"

Force="true"/>

<ModifyFile

Path="$(SolutionName).exe.manifest"

RegularExpression="<application />"

NewValue="<description asmv2:iconFile="$(SolutionName).ico" xmlns="urn:schemas-microsoft-com:asm.v1" /><application />"

Force="true"/>

<GenerateDeploymentManifest AssemblyName="$(ClickOnceAppTitle).application"

AssemblyVersion="%(GetVersionAssemblyInfo.Version)"

DeploymentUrl="$(ClickOnceApplicationUrl)"

Description="Hagemeyer N.A. ControlNET ERP System"

Product="$(ClickOnceAppTitle)"

Publisher="$(Company)"

SupportUrl="$(SupportUrl)"

EntryPoint="$(SolutionName).exe.manifest"

Install="true"

UpdateEnabled="true"

UpdateMode="Background"

OutputManifest="$(SolutionName).application"

MapFileExtensions="true"/>

</GetFrameworkSdkPath>

<GenerateBootstrapper

ApplicationFile="$(SolutionName).application"

ApplicationName="$(ClickOnceAppTitle)"

ApplicationUrl="$(ClickOnceUrl)"

BootstrapperItems="@(BootstrapperFile)"

Culture="en"

FallbackCulture="en-US"

CopyComponents="true"

Validate="false"

Path="$(SdkPath)\Bootstrapper"

OutputPath="." />

</Target>

</Target>

<Copy SourceFiles="@(ClickOnceInstallationFiles)"

DestinationFiles="@(ClickOnceInstallationFiles->'$(ClickOnceVirtualRootDir)\%(Filename)%(Extension)')"/>

<Copy SourceFiles="@(AppManifestContents)"

DestinationFiles="@(AppManifestContents->'$(ClickOnceVirtualRootDir)\%(RecursiveDir)%(Filename)%(Extension).deploy')"/>

</Target>

</Project>

Any idea what I might be missing?

The publish works great in VS2005

Running the Publish target in MSBuild without an MSBuild project, against the csproj file works, but doesn't give me an HTML page to launch with, hence the MSBuild project.

I can't figure out what I might be missing here.

Let me know if anyone might be able to help.

Thanks,
Murray Gordon

E.Krishna Kumar’s Weblog » Visual Studio 2005 Code Snippets

Murray Gordon — Tue, 18 Jul 2006 16:01:00 GMT

Visual Studio 2005 Code Snippets

IntelliSense Code Snippets are reusable, task-oriented blocks of code. Visual Studio 2005 includes code snippets covering tasks ranging from creating a custom exception, to sending an e-mail message, to drawing a circle. A set of Visual Basic and Visual C# Code Snippets are included in the Visual Studio 2005 box – additional Code Snippets can be found at: http://msdn.microsoft.com/vstudio/downloads/codesnippets/default.aspx

E.Krishna Kumar’s Weblog » Visual Studio 2005 Code Snippets.

Microsoft's Software Delevelopment Lifecycle (SDL) - Info from Microsoft's ISV CTO Summit

Murray Gordon — Fri, 14 Jul 2006 19:17:00 GMT

During the CTO panel discussion hosted by Bill Veghte, Corporate VP of Microsoft North America, Microsoft promised to provide a summary and best practices for their “Security Development Life cycle” (SDL). The following links outline the SDL process and SDL best practices that Microsoft uses internally. There are also reference resources within the blog entries where you can get additional information on the SDL process.

You can find those here on my blog:

For the last four years Microsoft has been fully committed to the “Trust Worthy Computing Initiative” which follows the principles of SD³+C (Secure by Design, Default, Deployment + Communication Process). The SDL mainly focuses on the first two elements of the initiative.

For each element of SD³+C, security improvements must be put in place to augment the development process. Once they are identified and added to the existing development model, the model should resemble this:

You can visit the link below to get more information about Microsoft’s security initiatives.

http://www.microsoft.com/security/default.mspx

Hope you enjoy the material. I know I did. Very helpful info.

Thanks,
Murray

Microsoft's Security Development Lifecycle – Best Practices

Murray Gordon — Fri, 14 Jul 2006 18:39:00 GMT

Thought some of you might liek to check this out. Great info from the Microsoft Team.

Security Development Lifecycle – Best Practices

Leadership and Education

· Get management and executive buy in and spread awareness.

· All developers, testers and project/program managers must train for security and SDL.

· Threat modeling training should be incorporated in security training.

Product inception

· Identify the team that will be responsible for tracking and managing security for the product. The team should coordinate and communicate the status of security issues in the product.

· Designate a single person, the ‘security coordinator’, as an individual point of contact.

· Bug reporting tools should be configured to track security bugs by cause and effect.

· Tracking the security bug cause of the vulnerability should be logged.

· Define and document the security ‘bug bar’ for the product.

Design Practices

· Product or component that are designed or redesigned should be reviewed by security team.

· All functional and design specifications should contain a section describing impacts on security.

· Use ‘strong-named’ assemblies and request a minimal permission for managed code development

· Have some logic and consistency in how firewall exceptions are made if any.

Risk Analysis

· Complete threat models that address all functionality delivered by the product.

· Document mitigations to all vulnerabilities identified using the threat model in either functional or design specifications.

· Threat models and mitigations should be widely reviewed and agreed to by the product development team.

· All architects, developers, testers, program managers and other stakeholders with reasonable understanding of the software involved must be asked to both contribute to and review threat models.

Security Documents and Tools

· All the stakeholders must meet to identify and discuss what information customers will require in order to use the product securely. This process may involve reviewing usage scenarios with specific consideration of customer needs for documentation and tools.

· User training teams will need to establish a plan to create customer-facing security documentation. It is imperative that this document must be completed in conjunction with product release.

Development Practices

· Establish and document development best practices for the development team. Use the currently required versions of compilers, compile options, and tools to avoid delivering binaries with security vulnerabilities that can be avoided.

· Use current versions of code analysis tools for either native and/or managed code.

· New native code (C and C++) should not use several ‘banned’ versions of string buffer handling functions.

· Shipping binaries must not contain sections marked as ‘shared’. These represent a potential security threat and should not be used. Properly secured dynamically created shared memory objects should be used instead.

Testing Practices

· Testing plans should be created and successfully completed that address the following issues:

o Security features and functionality act as specified to ensure all of the security features and functionality intended to mitigate threats perform as expected.

o Security features and functionality function can’t be circumvented: A mitigation that can be bypassed represents a way that an attacker may attempt to exploit software.

· Validating all data input and parsing code against malformed or unexpected data is a common way that attackers attempt to exploit software. Data fuzzing is an example of a general testing technique that can help prevent such attacks.

· Test using File fuzzing and RPC fuzzing techniques.

· Penetration testing: Using the threat models to determine priorities, test and attack the software as a hacker might, using existing tools or designing new tools if needed.

· Review and update threat models if needed. Threat models should be reviewed in order to ensure they remain accurate and comprehensively cover all functionality delivered by the software. Threat models should be used to drive security testing plans.

· Re-evaluate the attack surface of the software. After the attack surface has been evaluated, attack surface documentation should be updated as appropriate.

Security Push

· Review and update threat models.

· Conduct code reviews for at-risk components.

· Identify development and testing owners for everything in product. A development ‘owner’ must be identified for each source code file. A QA ‘owner’ must be identified for each binary file.

· Code review priority. All code must be prioritized prior to the push starting.

o Priority1 code is the code that is considered to be the most sensitive from a security standpoint.

§ All Internet- or network-facing code

§ Code in the Trusted Computing Base (“TCB”) (ex: kernel or SYSTEM code)

§ Code running as administrator or Local System, code running as an elevated user (also includes LocalService and NetworkService), or features with a prior history of vulnerability, regardless of version.

§ Any code that handles secret data, such as encryption keys and passwords, is considered Priority1 code.

§ For managed code, Priority1 code is considered to be any unverifiable code (any code that the standard PEVerify.exe tool reports as not verified).

§ All code supporting functionality exposed on the maximum attack surface is considered Priority1 code by definition.

o Priority2 is optionally installed code that runs with user privilege, or code that is installed by default that doesn’t meet the pri1 criteria listed.

o Priority3 is rarely used code and setup code. Setup code that handles secret data, such as encryption keys and passwords, is always considered Priority1 code.

· Any code or component with high rates of security bug discovery is considered to be Priority1 code, even if it otherwise maps to Priority2 or Priority3 per the previous definitions. While the definition of high rates is subjective within the team, it is important to examine with extra scrutiny the portions of code that have experienced the highest rates of security bugs.

· Include and prioritize all sample code shipped with the product. While generalized guidelines are difficult, consider how customers will be using the samples. Samples that are expected to be compiled and used with little changes in production environments should be considered ’Priority1’.

· Review the security documentation plan. Examine how any changes to the product design that occurred during the development phase have impacted security documentation. Ensure that the security documentation plan will meet all customer needs.

· Re-evaluate the attack surface of the software. After the attack surface has been evaluated, attack surface documentation should be updated as appropriate.

· Focus the entire team on the push. There should be cross team assistance

Final Security Review

· Make sure the software is ready to ship.

· Product team coordination and collaboration for threat modeling review.

· Review of unfixed security bugs and tools-use verification.

Response Planning

· The software must have a publicly defined support policy that clearly identifies what versions are supported, for how long and in what manner.

· Resources (Development, QA and Program Management) must be identified within the product team that can work on security response issues.

· All code in the product must have an identified owner.

· The software must have a documented sustaining model that addresses the need to release immediate patches in response to security vulnerabilities, and is not wholly dependent on infrequent service packs.

· There must be a consistent and comprehensible policy for security response for components that are released out of band but that can be used to update or enhance the software after it has released

· The product team must complete the information needed for an Emergency Response Plan.

Resources:

Craig Mundie, Trustworthy Computing White Paper http://www.microsoft.com/mscorp/twc/twc_whitepaper.mspx

Michael Howard, Attack Surface: Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users, MSDN Magazine, November 2004 http://msdn.microsoft.com/msdnmag/issues/04/11/default.aspx

Michael Howard, Expert Tips for Finding Security Defects in Your Code, MSDN Magazine, November 2003

http://msdn.microsoft.com/msdnmag/issues/03/11/default.aspx

Michael Howard and David LeBlanc, Writing Secure Code, Second Edition, Microsoft Press, Redmond, Washington, 2003

http://www.amazon.com/gp/product/0735617228/102-5060284-6046544

Frank Swiderski and Window Snyder, Threat Modeling, Microsoft Press, Redmond Washington, 2004

http://www.amazon.com/gp/product/0735619913/102-5060284-6046544

Michael Howard and Steve Lipner, The Security Development Lifecycle, Microsoft Press, Redmond Washington 2006

http://www.amazon.com/gp/product/0735622140/102-5060284-6046544

Microsoft's Security Development Lifecycle - Overview

Murray Gordon — Fri, 14 Jul 2006 18:36:00 GMT

Thought some of you might like to check this out. Great info from the Microsoft Team.

Security Development Lifecycle - Overview

The goals of Security Development Lifecycle (SDL) is to reduce the number of security related design and coding defects and to minimize the severity of defects that are undetected. SDL mainly focuses on first two elements of Secure by Design, Secure by Default, Secure by Deployment + Communication Process¹ ( SD³+C) . SDL is software methodology agnostic. SDL enhances the software development process by integrating measures that lead to improve security.

Let’s take a look at the major phases of SDL and outline what you can do in your organization to implement SDL.

Leadership and Education

In addition to executive sponsorship and visibility, organizational accountability is key. There should be one or more individuals that are designated as the point people for security. Their jobs includes staying on top of security issues, promoting security practices within the development organization and being the voice of reason when it comes to making tough security decisions. They should monitor the various security related newsgroups, hold presentations on security topics (like common security code defects, buffer overflow, cross-site scripting, SQL injection, integer arithmetic, weak crypto, and so on), and play a key role in secure design, threat modeling, and security testing.

All engineering staff should be encouraged to update their security related skills at least once a year (whether on their own or by attending staff development events) These activities should be tracked so people don't fall between the cracks. It's critical that your engineering staff are aware of the current security landscape. It tends to change very rapidly.

Some good sources for online and instructor-led security education include Microsoft eLearning (www.microsoftelearning.com/security). Recommended reading includes Writing Secure Code, Threat Modeling, Software Security – Building Security in.

Requirement and Design Phase

The best opportunity to influence the security design of a software product is early in requirement and design phase. All functional and design specifications should contain a section describing security².
Functional specifications should describe security features that will be directly exposed to the customers such as data gathering on forms, authentication by user password. Also advanced functionality and design specification should describe how to implement security features and make sure that all the functionality is implemented as secure features.

When designing features, it is crucial to carefully consider security concerns. Security must be planed into all projects from the beginning. It cannot be ‘injected’ at the end of the process. Features should be engineered with respect to security, such as robust use of Crypto APIs, use of managed code wherever possible, rigorously validating all data before processing it, and several other considerations.

SDL mandates that engineers spend time in the design phase to think about security of features and implementing secure design. An important part of the design process is understanding how to reduce the attack surface of applications or components³.

Threat Modeling

Understanding the threats to your software is a critical step to creating a secure product. Too many people bolt security technology to their app and declare it secure. The code is not secure unless the security countermeasures prevent the package from being compromised by all reasonable real-world threats. That's the goal of threat modeling⁴. Threat models are critical components of the design phase and will reference both a product's functional and design specifications to describe both vulnerabilities and mitigations.

Threat modeling must be completed during the product design process. A team cannot build a secure product unless it understands the assets the product is trying to protect. It is also important to consider threats and vulnerabilities present in the environment in which the product is deployed, or those that arise due to interaction and interfaces with other products or systems in real world solutions. The design phase of a product cannot be considered complete until a threat model is in place.

Development Phase

During the development phase you should implement security tools, security checklists, and secure coding best practice to help implement a secure design. Remember, a secure design could quite easily be rendered insecure by a weak implementation.

Security tools help, but tools alone do not make code resilient to attack. There is simply no replacement for having a knowledgeable work force that will use the tools to enforce policy. The new version of Visual Studio® 2005 Team System Developer's Edition includes some very, very useful security tools like PREFast⁵, SAL⁶, FxCop⁷, Application Verifier⁸.

Security Testing

To build secure software, you must get as much right as possible in design and implementation phases. Testing should be mainly the verification phase. A very useful testing technique for finding security defects is "fuzzing⁹¹⁰," which means taking valid data, morphing that data, and then observing how the application consumes the data. Other testing phase steps include Penetration testing, Runtime verification. For critical products, penetration testing should be done by external resources.

You should re-review the threat model and re-evaluate the attack surface area of the software in this phase.

Security Push

A security push is a team-wide focus on threat model updates, code review, testing, and documentation scrubing. The security push is not limited to code, the main tasks during the push are training, code reviews, threat model updates, security testing, document scrub. The determination of the completion of the security push should be based on task completion not on time elapsed. The exit criteria should be actionable and crisp and should be communicated widely to all the stake holders.

Final Security Reviews

The Final Security Review (FSR) insures that the software is ready to ship from a security point of view. It's performed by the central security team with help from the product team. It should not be performed by the product team alone. The following components make up the FSR process – Product team coordination, threat modeling review, unfixed security bugs review and tools-use verification.
At the end of the FSR process, the findings are written up and a decision is made about releasing the software or reworking sections.

Security Response

There are two major parts to security response, one is responding to security defects and working with people who find security issues in your code. The other aspect is learning from these mistakes.

The response team should encompass a “security response” team that faces customers and researchers and the product team that investigates and eliminates security vulnerabilities. The product team must learn from each vulnerability report and find related vulnerabilities and fix them in the security update and update the SDK process based on the lesson learned.

Resources:

http://msdn.microsoft.com/msdnmag/issues/03/11/default.aspx

Michael Howard and David LeBlanc, Writing Secure Code, Second Edition, Microsoft Press, Redmond, Washington, 2003

http://www.amazon.com/gp/product/0735617228/102-5060284-6046544

Frank Swiderski and Window Snyder, Threat Modeling, Microsoft Press, Redmond Washington, 2004

http://www.amazon.com/gp/product/0735619913/102-5060284-6046544

Michael Howard and Steve Lipner, The Security Development Lifecycle, Microsoft Press, Redmond Washington 2006

http://www.amazon.com/gp/product/0735622140/102-5060284-6046544

Endnotes:

¹http://msdn.microsoft.com/msdntv/episode.aspx?xml=episodes/en/20030513SecurityMH/manifest.xml

²http://www.faqs.org/rfcs/rfc3552.html

³http://msdn.microsoft.com/msdnmag/issues/04/11/AttackSurface/

⁴http://blogs.msdn.com/ptorr/archive/2005/02/22/GuerillaThreatModelling.aspx

⁵http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcepbguide5/html/wce50oriPREfastAnalysisTool.asp

⁶http://msdn2.microsoft.com/en-us/library/ms235402.aspx

⁷http://www.gotdotnet.com/team/fxcop/

⁸http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wcedebug5/html/wce50conApplicationVerifierTool.asp

⁹http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-sutton.pdf

¹⁰http://www.blackhat.com/presentations/bh-usa-05/bh-us-05-nuwere/bh-us-05-nuwere.pdf

ASP.NET Session State timeout

Murray Gordon — Fri, 07 Jul 2006 16:57:00 GMT

We have been having some problems with our client application timing out on us.

We have a .NET C# Smart Client that connects to a remote server.
The remote server serves up Remoting Objects over HTTPS to the Smart Client using an IIS .NET 2.0 Web Application.
Our remoted objects have a lifetime leaseTime of 0 or “forever”.

But for some reason our user’s kept getting timed out after 20 minutes.

Finally we figure out that our ASP.NET web application has a default timeout of 20.

Here is the parameter for the web.config that controls the ASP.NET timeout:

The number for the timeout must be an integer, and it is in minutes. What we found in our project was that unless the web.config had a parameter setting the time to keep an ASP.NET session alive it would terminate it after 20 minutes and the app would throw exceptions.

The parameter goes anywhere within the <system.web> portion of the configuration section of web.config. Hopefully that will help anyone else having this type of problem.

Thanks,
Murray