.NET Framework 1.1 Security Guidelines

From Guidance Share

- J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan

Contents 1 Assembly Design Considerations 2 Class Design Considerations 3 Cryptography 4 Delegates 5 Exception Management 6 File I/O 7 Obfuscation 8 Reflection 9 Registry 10 Serialization 11 Strong Names 12 Threading 13 Unmanaged Code

Assembly Design Considerations

• Identify privileged code
• Identify the trust level of your target environment
• Sandbox highly privileged code
• Design your public interface

Class Design Considerations

• Restrict class and member visibility
• Seal non base classes
• Restrict which users can call your code
• Expose fields using properties

Cryptography

• Use platform-provided cryptographic services
• Generate random keys
• Use PasswordDeriveBytes for password-based encryption
• Prefer large keys
• Use DPAPI to avoid key management
• Do not store keys in code
• Restrict access to persisted keys
• Cycle keys periodically
• Key Compromise

Delegates

• Do Not Accept Delegates from Untrusted Sources

Exception Management

• Use structured exception handling
• Do not log sensitive data
• Do not reveal system or sensitive application information
• Consider exception filter issues
• Consider an exception management framework

File I/O

• Avoid untrusted input for file names
• Do not trust environment variables
• Validate input filenames
• Constrain file I/O within your application's context

Obfuscation

• Use obfuscation to protect your intellectual property

Reflection

• Security issues when using Reflection

Registry

• Encrypt the data stored in the registry

Serialization

• Do not serialize sensitive data
• Validate serialized data streams

Strong Names

• Strong Name your assemblies
• Delay sign your assemblies
• Authenticode your assemblies

Threading

• Do not cache the results of security checks
• Consider impersonation tokens
• Synchronize static class constructors
• Synchronize Dispose methods

Unmanaged Code

• Validate input and output string parameters
• Validate array bounds
• Check file path lengths
• Compile unmanaged code with the /GS switch
• Inspect unmanaged code for 'dangerous' APIs