This post originally appears on CodeProject.com
I’ve been spending a lot of time thinking about application security recently. This used to be one of those topics I would plan to implement last when I read specification documents for projects. “Security is easy … just put a few If/Then statements around the things that need to be secured and we’re done, right?” Then I went shopping at a large American retailer in the winter of 2013. Their systems were compromised and three months later, my credit card was shut off while I was attempting to pay for dinner at a nice restaurant. That hurt … and security of applications suddenly became a problem that hurt me in a REAL way.
When I think about all of the .NET applications that I have written over the last 10 years, I’m sure there are many features that could use an improvement to their authorization policies. Perhaps that customized authentication provider I wrote could be hardened a bit more. I think I’ve tried to play the security expert too much in the past, and if I were in a place to maintain those applications today, I would be thinking real hard about how to implement better security in them. After doing some research and looking at the new techniques published by Microsoft for securing their frameworks, I think I found a third party solution that does a great job with green-field and brown-field applications.
I’ve been reviewing Novalys Visual Guard for the last 2 weeks, and found some really interesting nuggets in this package that would make my network administrators stand up and take notice. Let’s start with the basics: Visual Guard will let me configure a secure repository for my organization in several mediums including Microsoft SQL Server, Oracle Database, and a file share. In this repository, I can connect Active Directory or any number of third party OAuth providers for my users. Sweet! However, storing user credentials is just the tip of the iceberg.
User Authentication is the door that opens to get access to an application. It is your logon page, the logon screen, and the persisting of those credentials for the duration of time that someone is using one of your secured applications. Notice the use of the plural there: applications. Visual Guard allows me to configure a security repository that can administer many applications for a shared user base. With theVisual Guard console, I can clearly see what applications are managed and the permissions available inside of each application. Let’s go over that again: permissions for an application are managed outside of the application.
Even better than permissions managed outside of the application, I can configure multiple servers to manage the authentication and authorization rights in my application. That gives me scalability, and according to the manuals that I read through, it is even possible to configure Visual Guard to allow management of users and permissions with a web based console. There’s a ton of flexibility in the deployment of the Visual Guard server, and I’ve only just scratched the surface.
The web-based console can have its look and layout customized, even integrated into my application so that it appears seamlessly alongside my content. I can then review and manage security from anywhere in the world, with any device that can connect to my website.
The windows console shows a tree of information about an application, like this one for the Console itself. You can clearly see the permissions available under the Visual Guard Console – Permissions folder. These permissions are grouped into Permission Sets and then assigned to Roles. Finally, roles can be assigned to users to grant authorization inside of your applications. With one set of credentials, I now have a single-sign-on across all applications that are integrated with my instances of the Visual Guard server.
The killer feature here is the integration with your application. This is where I really saw an application for those long-life applications that I wrote many years ago. You can add Visual Guard on to an existing web application without having to recompile! Due to the provider model of the ASP.NET web forms project, as long as your login page is using the security providers defined in web.config, you should be able to swap out the authentication provider for Visual Guard. After that, the addition of an HttpModule is all you need to secure the rest of the application. Visual Guard secures your application by intercepting normal events as they occur, and allows you to specify what actions to take at those events.
Each permission defined in Visual Guard can have Property Actions or Script Actions associated with it. These are codified changes to make to your application, written and managed in the administrative console and executed at run-time of the application. You can do something as simple as create a ViewGrid permission and set the Visible property on a grid to true if the user has that permission. Once the permissions are defined, this can be managed by your operations or security teams with no intervention from a developer required. There are more advanced integrations available that involve a developer modifying code to provide additional security checks if that is what you require. However, this is too cool for me to be able to delegate the authorization checks of my application to the operations team!
Another interesting feature that Visual Guard could help me with is multi-tenancy. I have architected and written several large multi-tenant applications in my past, and the story of data access and security is always a sticky one to describe and get correct with thousands of lines of code to manage. Visual Guard has built in inheritance of permissions from group to child-group. This hierarchy is a nightmare to manage in a SQL database, and I can now rely on Visual Guard to apply that hierarchy and data-filter for me.
Finally, there is always a question of accountability. Who performed what secured operation and what time in the application? In the past, I’ve written huge database tables and logging mechanisms to provide this auditability of secure content. Visual Guard provides an audit report that outputs all records of security checks in your applications. After having handcrafted several of these services, I am happy to see that I don’t need to do that again. According to the docs from Novalys, Visual Guard is HIPPA and SOX compliant … another headache that I can leave to professionals who are focused on that task.
My mindset on security has changed. No longer do I view it as an afterthought that can be added to my code once I have the core functionality working. Now I see security as something that I can partner with my operations team to implement. I can enable them to secure the services we are producing with the help of Novalys Visual Guard. This leads to more secure systems, security officers who are more aware of how software services are secured and more secure control of authorization capabilities within those facilities.
Disclosure of Material Connection: I received one or more of the products or services mentioned above for free in the hope that I would mention it on my blog. Regardless, I only recommend products or services I use personally and believe my readers will enjoy. I am disclosing this in accordance with the Federal Trade Commission’s 16 CFR, Part 255: “Guides Concerning the Use of Endorsements and Testimonials in Advertising.