9/21/2006 3:09 PM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
Daniel MeyerDaniel MeyerIdentity and Access Management Lead Identity and Access Management Lead Europe, Middle East & AfricaEurope, Middle East & AfricaMicrosoft CorporationMicrosoft Corporation
Services as IdentitiesServices as Identities
Application to Application
Rich Interactions- Office- Real time
Communications- Live Meeting
Rich ClientDevices & Apps
Web Browsers
WebService
WebService
WebService
WebService
Web Server
InternetOrganization PartnerWeb
ServiceWeb
Service
ApplikationsintegrationApplikationsintegration und und ––interaktioninteraktion durchdurch Web ServicesWeb Services
Da Web Services auf Internettechnologien Da Web Services auf Internettechnologien basieren, sind sie mit den gleichen basieren, sind sie mit den gleichen Methoden wie diese angreifbarMethoden wie diese angreifbar
RisikenRisiken
PCServer Running XML
Web serviceBad Guy
Man In The Middle Man In The Middle SOAP monitoring tool to simulate the man in the middleSOAP monitoring tool to simulate the man in the middleIn reality this could be an intermediary, router, In reality this could be an intermediary, router, firewall, etc.firewall, etc.
Message Protection Message Protection Integrity and ConfidentialityIntegrity and Confidentiality
ThreatsThreatsNetwork eavesdropping leads to disclosure of confidential informNetwork eavesdropping leads to disclosure of confidential informationationAn attacker manipulates a message in transit influencing the An attacker manipulates a message in transit influencing the serviceservice’’s behaviors behavior
VulnerabilitiesVulnerabilitiesLack of Lack of end to end end to end encryptionencryption when when sending SOAP messagessending SOAP messagesLack of a Lack of a digital signaturedigital signatureto verify authenticity of a to verify authenticity of a SOAP messageSOAP message
CountermeasuresCountermeasuresMessage Protection Message Protection Patterns: Patterns:
Data Origin AuthenticationData Origin AuthenticationData ConfidentialityData Confidentiality
9/21/2006 3:09 PM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
Replay DetectionReplay DetectionThreatsThreats
A replayed message will often cause data inconsistencies (especiA replayed message will often cause data inconsistencies (especially true of ally true of update operations)update operations)Messages may traverse unMessages may traverse un--trusted intermediaries on an insecure network, trusted intermediaries on an insecure network, any of whom could capture the message and replay any of whom could capture the message and replay
VulnerabilitiesVulnerabilitiesLimited support for Limited support for preventing replayed messagespreventing replayed messagesMany replay caches do not support web farmsMany replay caches do not support web farms
CountermeasuresCountermeasuresReplay Detection PatternReplay Detection Pattern
Message ValidationMessage ValidationThreatsThreats
Message data may be Message data may be malformedmalformed for malicious intentions such as for malicious intentions such as injection attacksinjection attacks
VulnerabilitiesVulnerabilitiesXML serialization helps validate some data types as XML data froXML serialization helps validate some data types as XML data from m the message is transformed into .Net data types the message is transformed into .Net data types –– but this does not but this does not prevent against malicious content with a string being used for Xprevent against malicious content with a string being used for XML ML or SQL injection attacks etc.or SQL injection attacks etc.
CountermeasuresCountermeasuresMessage Validation PatternMessage Validation Pattern
Service Perimeter RouterService Perimeter RouterThreatsThreats
Compromise of Web Compromise of Web services that access services that access internal resources may internal resources may lead to compromise of lead to compromise of dependent resources dependent resources such as databasessuch as databases
VulnerabilitiesVulnerabilitiesVulnerabilities in OS, Vulnerabilities in OS, Web serviceWeb service etc may etc may lead to compromise of lead to compromise of the host of a web the host of a web service. service.
CountermeasuresCountermeasuresService Perimeter Router Service Perimeter Router PatternPattern
BedrohungenBedrohungen und und RisikenRisiken in SOA in SOA UmgebungenUmgebungen•• UnauthorisierterUnauthorisierter ZugriffZugriff auf auf NetzwerkeNetzwerke•• PrivilegierterPrivilegierter ZugangZugang mitmit nichtnicht authorisiertenauthorisierten
MittelnMitteln•• MissbrauchMissbrauch von von DienstenDiensten•• SicherheitslSicherheitslüückencken in in AnwendungenAnwendungen•• VerfVerfäälschunglschung von von DatenDaten•• DatenmissbrauchDatenmissbrauch•• UnerwUnerwüünschtenschte WeitergabeWeitergabe von von DatenDaten
((IndustriespionageIndustriespionage))
Connected ApplicationsConnected Applications
MessagingMessaging
XMLXML
TransportsTransports
SecuritySecurity ReliableReliableDeliveryDelivery
TransactionsTransactions
Metadata
Metadata
ManagementManagement Business Business ProcessProcess ……
WSWS--* Specifications* Specifications
DevicesDevices MobileMobile
P2PP2P EAIEAI B2BB2B GridGrid
WSWS--* * ComposabilityComposability
Addressing
<S:Envelope … ><S:Header>
<wsa:ReplyTo><wsa:Address>http://business456.com/User12</wsa:Address>
</wsa:ReplyTo><wsa:To>http://fabrikam123.com/Traffic</wsa:To><wsa:Action>http://fabrikam123.com/Traffic/Status</wsa:Action><wssec:Security>
<wssec:BinarySecurityTokenValueType="wssec:X509v3" EncodingType=“wssec:Base64Binary">
dWJzY3JpYmVyLVBlc…..eFw0wMTEwMTAwMD</wssec:BinarySecurityToken>
</wssec:Security><wsrm:Sequence>
<wsu:Identifier>http://fabrikam123.com/seq1234</wsu:Identifier><wsrm:MessageNumber>10</wsrm:MessageNumber>
</wsrm:Sequence></S:Header><S:Body>
<app:TrafficStatusxmlns:app="http://highwaymon.org/payloads">
<road>520W</road><speed>3MPH</speed></app:TrafficStatus>
</S:Body></S:Envelope>
Security
Reliability
9/21/2006 3:09 PM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
WS-Trust, WS-MetadataExchange
WSWS--* Metasystem Architecture* Metasystem Architecture
SecurityTokenServer
Kerberos
WS-SecurityPolicy
SAML
Identity Selector
SecurityTokenServer
WS-SecurityPolicy
CustomSecurity
ID ProviderID Provider
x509
ID ProviderID Provider
SubjectSubject
Relying PartyRelying Party Relying PartyRelying Party
WSWS--FederationFederationWeb Services Federation LanguageWeb Services Federation Language
Defines messages to enable security realms to Defines messages to enable security realms to federate & exchange security tokensfederate & exchange security tokens
BEA, IBM, Microsoft, RSA, BEA, IBM, Microsoft, RSA, VeriSignVeriSignTwo Two ““profilesprofiles”” of the model definedof the model defined
Passive (Browser) clients Passive (Browser) clients –– HTTP/SHTTP/SActive (Smart) clients Active (Smart) clients –– SOAPSOAP
SecuritySecurityTokenToken
ServiceService
HTTPHTTPReceiverReceiver
HTTP messagesHTTP messages
SOAP messagesSOAP messagesSOAPSOAP
ReceiverReceiver
WSWS--Federation InteroperabilityFederation Interoperability
WSWS--* public workshops/spec reviews* public workshops/spec reviewshttp://http://groups.yahoo.comgroups.yahoo.com/group/WS/group/WS--SecuritySecurity--Workshops/Workshops/
Passive Requestor Passive Requestor InteropInterop Profile (2004) Profile (2004) Microsoft, IBM, RSA, Oracle (Microsoft, IBM, RSA, Oracle (OblixOblix), BMC (), BMC (OpenNetworkOpenNetwork), CA ), CA ((NetegrityNetegrity), ), PingIDPingID
WSWS--Fed Product previews (2004)Fed Product previews (2004)TechEdTechEd InteropInterop pavilion & Vendor panelpavilion & Vendor panel
WSWS--Fed Product interoperability (2005)Fed Product interoperability (2005)Burton CatalystBurton Catalyst
MultiMulti--protocol Federated Identity protocol Federated Identity InteropInterop DemonstrationDemonstrationMicrosoft, IBM, BMC, Microsoft, IBM, BMC, PingIDPingID, , SymabsSymabs, , TrustgenixTrustgenix, , DataPowerDataPower Guidance
Developer Tools
SystemsManagementActive Directory Active Directory
Federation Services Federation Services (ADFS)(ADFS)
IdentityManagement
Services
Information Protection
Encrypting File System (EFS)
Encrypting File System (EFS)BitLockerBitLocker™™
Network Access Protection (NAP)
Client and Server OS
Server Applications
Edge
Schutz von Daten und Infrastruktur Schutz von Daten und Infrastruktur
Tools und TechnologienTools und TechnologienMicrosoft Tools, die eine Entwicklung sicherer Web Services Microsoft Tools, die eine Entwicklung sicherer Web Services unterstunterstüützentzen
.NET Framework.NET FrameworkADFS / STSADFS / STSVisual StudioVisual StudioWebservices Webservices EnhancementEnhancement (WSE)(WSE)Windows Communication Windows Communication FoundationFoundation (WCF)(WCF)Windows Windows WorkflowWorkflow FoundationFoundationWindows Windows CardSpaceCardSpaceBizTalk ServerBizTalk ServerDarDarüüber hinaus bieten die weiteren bekannten Microsoft ber hinaus bieten die weiteren bekannten Microsoft
AnwenderAnwender-- und Enterpriseprodukte die Bereitstellung, und Enterpriseprodukte die Bereitstellung, Nutzung und Verwaltung von Web ServicesNutzung und Verwaltung von Web Services
MicrosoftMicrosoft’’s Security Development Lifecycles Security Development LifecycleUnternehmensweiterUnternehmensweiter ProzessProzess und Standard und Standard ffüürr die die EntwicklungEntwicklung sicherersicherer SoftwareSoftwareInterne Interne VermittlungVermittlung durchdurch SchulungSchulungÜÜberprberprüüfungfung durchdurch Audits Audits vorvor AuslieferungAuslieferungThe Security Development LifecycleThe Security Development Lifecycle bookbook
BeteiligungBeteiligung auchauch von Softwarevon Software-- und ITund IT--EntwicklungspartnernEntwicklungspartnern
DokumentationDokumentation und Training und Training FortbildungsplFortbildungspläänene ffüürr SicherheitSicherheitAktiveAktive EinbeziehungEinbeziehung in Communitiesin Communities
AutomatisiertAutomatisiert mitmit Tools in Visual StudioTools in Visual StudioPREPREffastastFxCopFxCop
9/21/2006 3:09 PM
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
FazitFazit
Sicherheit auch fSicherheit auch füür Web Services ist r Web Services ist mmööglichglichIn Folge der Sicherheitsinitiative hat In Folge der Sicherheitsinitiative hat Microsoft Prozesse und Produkte fMicrosoft Prozesse und Produkte füür die r die Entwicklung sicherer Anwendungen Entwicklung sicherer Anwendungen geschaffengeschaffenWeitere Informationen zu Web Services Weitere Informationen zu Web Services SecuritySecurity: : http://http://www.microsoft.comwww.microsoft.com//germanygermany//msdnmsdn//securitysecurity//webservices.mspxwebservices.mspx
©© 2006 Microsoft Corporation. All rights reserved. Microsoft, Win2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registdows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countered trademarks and/or trademarks in the U.S. and/or other countries.ries.The information herein is for informational purposes only and reThe information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the datpresents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to change of this presentation. Because Microsoft must respond to changing market conditions, it should not be ing market conditions, it should not be
interpreted to be a commitment on the part of Microsoft, and Micinterpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information providedrosoft cannot guarantee the accuracy of any information provided after the date of this presentation. after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, ASMICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.TO THE INFORMATION IN THIS PRESENTATION.