CORE SECURITY TECHNOLOGIES, a leading provider of state-of-the-art Information Security technology and Foundstone Inc., a premier provider of managed and professional security assessment services and education, today announced a new publication: Security in the the Microsoft® .NET Framework
From the early stages of the development of the .NET Framework, Foundstone, Inc. and CORE SECURITY TECHNOLOGIES have assisted Microsoft Corp. with analyzing and assessing the security of its architecture and implementation
The analysis of the .NET Framework began in the summer of 2000, before the first Beta release of the software and continued up through the Beta 2. The entire engagement encompassed over 2,800 hours of rigorous, independent security auditing and testing.
This white paper focuses on the broad security features of the .NET Framework. It is based largely on the results of the assessment we performed over the last year and our continued interaction with the .NET Framework development team. The thoughts and opinions expressed herein are solely our own independent observations based on rigorous analysis and testing of many builds of the software. It is our hope that this document will promote understanding of security in the .NET Framework, and convey our confidence in that architecture and its implementation.
Abstract
This paper presents an overview of the security architecture of Microsoft’s .NET Framework This paper is based on a long-term, independent security analysis performed by Foundstone, Inc. and CORE Security Technologies, beginning in the summer of 2000.
Our analysis revealed that, used properly, the .NET Framework gives developers and administrators granular security control over their applications and resources; provides developers with an easy-to-use toolset to implement powerful authentication, authorization, and cryptographic routines; eliminates many of the major security risks facing applications today due to flawed code (such as buffer overflows); and shifts the burden from having to make critical security decisions -- such as whether or not to run a particular application or what resources that application should be able to access – from end users to developers and administrators.
In the course of this document, we will explain how the .NET Framework’s evidence- and role-based security features, code access security, verification process, cryptography support, isolated storage, and application domains work together to achieve these outcomes, providing a robust platform for developing and running all types of software applications, both client- and server-side. We conclude that the .NET Framework can provide organizations with greater assurance that their applications can resist known security attacks today and in the future.