During the amazing Umbraco Code Garden 2015 I presented a session titled 'Securing your Umbraco'. The session covered common web security risks and how with Umbraco we can mitigate those risks. The talk covered: HTTPS Umbraco Setup Cookies Input and Outputs Self Testing Pen Testing Watch the talk back on the Umbraco stream http://stream.umbraco.org/video/11666249/securing-your-umbraco

1. S E C U R I N G Y O U R
U M B R A C O

2. C H R I S G A S K E L L
@ C G A S K E L L
C H R I S @ D E T A N G L E D -
D I G I T A L . C O M

3. I ’ M N O T A H A C K E R

4. HTTPS
Umbraco Setup
Cookies
Input and Outputs
Self Testing
Pen Testing

5. – K E V I N M I T N I C K
“Companies spend millions of dollars on firewalls,
encryption and secure access devices, and it’s
money wasted, because none of these measures
address the weakest link in the security chain.”

7. H T T P S : / / W W W . O W A S P . O R G
T H I S P R E S E N T A T I O N
I S P O W E R E D B Y
O W A S P
A N D M Y
E X P E R I E N C E S

8. B E F O R E Y O U S T A R T ,
T H I N K S E C U R I T Y

9. # 1
U P G R A D E U P G R A D E U P G R A D E

10. T H A N K S G A V

11. # 1
C A S E S T U D Y
Umbraco 4.7 running on an un patched Windows
2008 Server
This vulnerability was reported by Umbraco HQ
and patches made available immediately.

13. # 1
U P G R A D E U P G R A D E U P G R A D E
• Upgrade Umbraco
• Upgrade servers operating system
• Upgrade the .NET framework
• Upgrade your packages (Umbraco and Nuget)
• Upgrade your front end frameworks

14. # 2
H T T P S : / /

15. # 2
O P T I O N 1
S E C U R E Y O U R E N T I R E S I T E
O V E R H T T P S : / /

16. # 2
I N S T A L L T H E C E R T I F I C A T E

17. # 2
F R O N T E N D
Ensure HTTP requests are redirected to HTTPS.
To redirect the entire site why not use the URL
REWRITE module for IIS.

18. All page assets must
serve over HTTPS to
avoid
‘mixed mode’

19. # 2
B A C K O F F I C E - W E B . C O N F I G
Make sure that all of the requests in the back
office are called over HTTPS instead of HTTP

20. # 2
O P T I O N 2
S E C U R E P A R T S O F Y O U R S I T E
O V E R H T T P S : / /

21. # 2
F R O N T E N D
Switch a URL from HTTP to HTTPS based on the
document-type (alias), node id or template alias
with help from @leekelleher
G I T H U B . C O M / L E E K E L L E H E R / U M B R A C O - H T T P S - R E D I R E C T

22. # 2
O P T I O N 3
S E C U R E Y O U R S I T E O V E R
H T T P S : / / W I T H
I N F R A S T R U C T U R E

23. # 2
S E C U R E B Y N - T I E R
I N F R A S T R U C T U R E
1 - 4. Request ARR
5. ARR ‘Offloads’ SSL
6. HTTP request to application server
7 - 9. Application server responding
to ARR on HTTP
10. ARR encrypts response and
sends to client

24. # 3
H A N D L I N G Y O U R E R R O R S

25. # 3
H A N D L I N G Y O U R E R R O R S

26. # 3
H A N D L I N G Y O U R E R R O R S - 4 0 4
1. Update UmbracoSettings.config with the content node you wish to serve as
your error page
2. IIS7+You may find IIS handles the error. Add the following key to your
web.config just before the closing tag of the system.webServer section.

27. # 3
H A N D L I N G Y O U R E R R O R S - 5 0 0
1. Tell IIS to pass the error to Umbraco (same setting for
the 404)
2. Set the CustomErrors section of the web.config

28. # 4
R E S T R I C T A C C E S S T O T H E
B A C K O F F I C E

29. # 4
R E S T R I C T A C C E S S
Restrict access to ‘/umbraco' by IP using IIS Rewrite.
<rewrite>
<rules>
<rule name="Restrict URL" enabled="true" stopProcessing="true" >
<match url="^umbraco($|/)" />
<conditions logicalGrouping="MatchAll">
<!-- Use REMOTE_ADDR if your server is NOT behind load balancer -->
<add input="{REMOTE_ADDR}" pattern="^10.11.12.13$" negate="true" />
</conditions>
<action type="Redirect" url=“/page-not-found/“ />
</rule>
</rules>
</rewrite>

30. # 5
C O D E C O M M E N T S

31. # 5
C O M M E N T S
Use server side comments in your markup rather than
HTML comments

32. # 6
H T T P H E A D E R S

33. # 6
I I S / . N E T H T T P H E A D E R S
Server: The web server software being run by the
site. Typically for Umbraco: “Microsoft-IIS/7.5”
X-Powered-By: The collection (there can be
multiple) of application frameworks being run by
the site. Typically: “ASP.NET”
X-AspNet-Version: ASP.NET only header, typical
examples include “2.0.50727” and “4.0.30319”
X-AspNetMvc-Version: ASP.NET stack and
typical examples include “3.0”, “2.0” and “1.0”

34. – I E T F ( I N T E R N E T E N G I N E E R I N G T A S K F O R C E )
“Revealing the specific software version of the
server may allow the server machine to become
more vulnerable to attacks against software that is
known to contain security holes.”

35. # 6
H T T P H E A D E R S
‘Server’ header reads:
‘; DROP TABLE
servertyes; —
The web server on
reddit.com.

36. # 6
H T T P H E A D E R S
Removing the headers manually
isn't as straight forward as you may
initially expect.

37. # 6
H T T P H E A D E R S
StripHeaders IIS Module
G I T H U B . C O M / D I O N A C H / S T R I P H E A D E R S /

38. # 6
H T T P H E A D E R S
Umbraco used to serve a version header
‘X-Umbraco-Version’
This was removed from V4.8

39. # 6
H T T P H E A D E R S T O T H I N K
A B O U T A D D I N G

40. # 6
H T T P H E A D E R S
Header:
Strict-Transport-Security
Example:
ansport-Security: max-age=16070400; includeS

41. # 6
H T T P H E A D E R S
Header:
X-XSS-Protection
Example:
X-XSS-Protection: 1; mode=block

42. # 6
H T T P H E A D E R S
Header:
X-Frame-Options, Frame-Options
Example:
X-Frame-Options: SAMEORIGIN

43. # 6
H T T P H E A D E R S
Header:
curity-Policy, X-Content-Security-Policy, X-
Example:
Content-Security-Policy: default-src 'self'

44. # 7
C O O K I E S

45. # 7
C O O K I E S
Mark your cookies ‘HttpOnly’

46. # 7
C O O K I E S
Mark your cookies ‘Secure’ when
working over HTTPS

47. # 8
S A N I T I S I N G I N P U T S A N D
O U T P U T S

48. # 8
S A N I T I S I N G I N P U T S
X S S - V A L I D A T E R E Q U E S T

49. D O N ' T R E L Y O N
R E Q U E S T
V A L I D A T I O N F O R
X S S P R O T E C T I O N

50. # 8
F O R M S - S A N I T I S I N G I N P U T S
• Validate form fields both client and server side
• Where there are option types (dropdown, checkboxes etc) ensure the
value matches an available option
• Required fields
• Correct data type and length
• Data falls within an acceptable range
• Whitelist allowable values. The regex namespace is particularly useful
for checking to make sure an email address or URL is as expected.

51. # 8
M V C F O R M S - S A N I T I S I N G
I N P U T S
Use the Synchroniser token pattern
ValidateAntiForgeryToken

52. # 8
S Q L I N J E C T I O N - S A N I T I S I N G
I N P U T S
• Use Parameterised SQL commands for all data access, without exception.
• Do not use SqlCommand with a string parameter made up of a concatenated SQL String.
• Whitelist allowable values coming from the user. Use enums, TryParse or lookup values to
assure that the data coming from the user is as expected.
• Enums are still vulnerable to unexpected values because .NET only validates a successful cast
to the underlying data type, integer by default. Enum.IsDefined can validate whether the input
value is valid within the list of defined constants.
• Apply the principle of least privilege when setting up the Database User in your database of
choice. The database user should only be able to access items that make sense for the use
case.
• Use of the Entity Framework is a very effective SQL injection prevention mechanism. Remember
that building your own ad hoc queries in EF is just as susceptible to SQLi as a plain SQL query.
• When using SQL Server, prefer integrated authentication over SQL authentication.

53. # 8
F O R M S - S A N I T I S I N G O U T P U T S
Encode your outputs - if the nasties are in
then don't let them out.
RAZOR
@Model.Title
is encoded
WEBFORMS
From .NET 4+ use <%: text %>

54. # 9
B A C K U P B A C K U P B A C K U P

55. – C O D E S P A C E S , J U N E 2 0 1 4
“In summary, most of our data, backups, machine
configurations and offsite backups were either
partially or completely deleted. ”

56. # 1 0
T E S T Y O U R O W N S I T E
A S A F A W E B . C O M

57. # 1 1
H I R E A P E N E T R A T I O N T E S T E R
( P E N - T E S T I N G )

58. W W W . O W A S P . O R G
G I T H U B . C O M / L E E K E L L E H E R / U M B R A C O - H T T P S - R E D I R E C T
G I T H U B . C O M / D I O N A C H / S T R I P H E A D E R S /
W W W . R A P I D 7 . C O M
S T A H E R I . C O M
W W W . T R O Y H U N T . C O M
A S A F A W E B . C O M
Also thanks to
@ C G A S K E L L