Arguably the most significant benefit brought by the transition from Windows 9x to Windows NT-based operating systems has been the addition of a solid security infrastructure. Paradoxically, though, only a minority of developers have taken the time to truly familiarize themselves with the security features of Windows NT 4.0/2000.
I reckon this is for several reasons, the more evident of which is cultural inertia: It is still pretty common among programmers to believe that for some reason security does not really concern them, as they are not working on "critical" portions of a project. After all, absence of security barriers has rarely prevented a system from functioning. Another reason is that in many a project security receives a treatment similar to installation procedures: It is retrofitted into the code base near the end of the development cycle, when deadline pressures and the imperative to preserve the precedent effort push the designated developers to quickly "get it to work", injecting trade-offs and pre-cooked solutions they do not thoroughly understand.
Other developers genuinely attempt to confront the discipline, but they are discouraged by the complexity and dispersion of the technical papers from Microsoft.
Quite frankly, the official documentation is fairly comprehensive, but tends to act more as a reference guide to the APIs and configuration options than an organic coverage of the topic. This raises the barriers to entry to the subject, as most readers first refer to the papers with little or no preventive knowledge and very little time to make up for it.
If you almost automatically pass NULL to any LPSECURITY_ATTRIBUTES parameter in your code and operate the DCOM security configuration utility like you would manipulate nitroglycerin, do not despair: you are in a very crowded company, but there is hope, thanks to Keith Brown's Programming Windows Security. Brown openly admits having been in your shoes and can therefore understand your unease with the seemingly arcane terminology of the security world. His status as an expert software developer and trainer who later specialized in security, as compared to many other authors in this niche who exhibit an academic background and expect their readers to be more comfortable with math than Visual Studio, immensely helps the average developer face the subject in pragmatic and not traumatic way.
The first three chapters of the book present the essentials of security in the Windows platform -- in other words the big picture that everyone on your project team should clearly visualize, managers and network administrators included. Window stations, ACEs and trusting authorities find their definition here. Don't expect to find any code in this first section however, as the focus is entirely on defining the concepts and providing basic knowledge on which to build throughout the book.
Part Two basically picks up all of the concepts illustrated before, one by one, and explores their inner workings, their implications and their implementation through the system API. The language of choice for the samples is C++, but the extensive explanations should allow users of other languages to understand the code and replicate it in their development tools of choice with ease. After all, this is mostly an educational book rather than a how-to text filled with listings to cut and paste.
Part Three tackles the most recent issues of modern software security, examining the issues and technologies to properly implement (and administrate) security plans in a networked scenario, be it a "simple" file server, an n-tier object-based architecture or an application server publicly available on the Web. If you are a COM/MTS/COM+ developer, I recommend you thoroughly study chapter 9, which distills in just less than one hundred pages the historical evolution, the theory and the practice of Microsoft-oriented distributed security from MSRPC parameters all the way up to COM+ security roles.
After finishing reading Programming Windows Security I was surprised by how a single book could guide a nearly security-illiterate reader to very solid and concrete command of the subject in a fairly digestible fashion. In short, if your daily realm of development is a Microsoft platform, the only thing that will help your security efforts more than reading this book is reading it twice.
Electronic Review of Computer Books
Provides professional software developers with information on how Windows security works, including coverage of Kerberos, SSL, job objects, the new ACL model, COM+, and IIS 5.0. Also addressed are the differences between security in Windows 2000 and Windows NT 4.0. Annotation c. Book News, Inc., Portland, OR (booknews.com)
Read an Excerpt
As with most of my friends, I learned to program Windows by reading Charles Petzold's classic tome, Programming Windows. I then moved on to Jefferey Richter's seminal book for systems developers, Advanced Windows NT. Finally, I moved into the realm of objects with Kraig Brockschmidt's Inside OLE 2. With the release of Windows NT 4.0, I started using (and eventually teaching) COM as a way to build distributed applications. Until this point in my life, I'd been able to safely ignore security, and had long since suppressed the pangs of guilt I used to feel when passing NULL for LPSECURITY_ATTRIBUTES. Little did I know that my life was about to change forever.
It was a beautiful sunny day in Bellevue, Washington, when I drove up to the offices of Saros, a software development company where I was scheduled to give my first on-site presentation of Essential COM, DevelopMentor's flagship COM course that included coverage of the relatively new Windows NT 4.0 feature called DCOM. All the students in the class had packed in their own computers (these students were worn and grizzled Windows programmers, some of whom had lost the covers to their machines long ago). What made the situation interesting was that some of the students had machines belonging to various Windows NT domains, whereas others had standalone machines not associated with any domain. One student was even running Windows 95. It was a recipe for disaster. Everything had been going smoothly, and the students (and myself) were thoroughly enjoying the class, but the radical configuration in the classroom put quite a crimp in the DCOM lab exercise that morning. Virtually all the studentswere getting E_ACCESSDENIED and various and sundry error codes, and of course they all looked to me to fix the problem. I failed miserably that day, and had to admit to myself (and the students) that I didn't yet have a good enough grasp of Windows security to solve their problems. I've rarely felt so small.
Shortly after this soul-wrenching experience, I dedicated myself to the pursuit of a deep and practical understanding of Windows security. I solidified my commitment by agreeing to write a new course for DevelopMentor about services and security, and proceeded to spend three months of virtually uninterrupted time studying and experimenting with the Windows security APIs. I never knew that I'd end up falling in love. Since then, I've learned loads more and answered hundreds of questions on the DCOM mailing list regarding security issues, and reached thousands of students, conference attendees, and readers of Microsoft Systems Journal (now MSDN Magazine) with the message that security is a fascinating and approachable topic.
As the culmination of my effort, this book attempts to fill the gaping hole in the Windows systems programming canon by providing a reference for programmers that covers Windows security from the basics of principals, authorities, logon sessions, and DACLs all the way through COM+ security, one of the most subtle and sensitive beasts you'll encounter as a Windows programmer.
As a side effect of my predilection for distributed programming, this book is unique in that it addresses security with the distributed systems developer in mind; in fact, the original title of the book was Distributed Security in Windows NT. Of course, Microsoft's decision to rename their (beta, at the time) operating system from "Windows NT 5.0" to "Windows 2000" didn't bode well for my original title. Frankly, Distributed Security in Windows NT/2000 sounded really goofy. Thus the new title.
In any case, if you're a programmer who, not unlike myself a few years ago, feels a hollowness in the pit of your stomach as a result of being asked to add a security-related feature or debug a security-related problem in an application, I hope you"ll find that this book completes you.
This book covers security programming on Windows 2000 and Windows NT 4. Therefore, to avoid crossing the reader's eyes with "Windows 2000/NT" or similar nastiness, I'll simply refer to both of these operating systems as Windows. If I find the need to say anything specific about a distinct operating system (including Windows 9x), I'll use the full name.
Who Should Read This Book
This book was written for professional software developers involved in systems programming on Windows. The third part of the book was written for the subset of these programmers developing distributed systems (especially those using COM).
The first part of the book (the first three chapters) intentionally has no code in it, and instead speaks to the big picture, introducing terminology and concepts that will likely be useful not just for programmers but also for technical managers and advanced Windows users. If you are a manager and want to get a better understanding of Windows security, borrow this book from one of the developers on your team and rip out the first three chapters for yourself. Sharing a common terminology will help you and your development team play better together.
What a Developer Should Already Know
I assume you have a basic understanding of Windows system programming; that is, you know the difference between a process and a thread, and you've written a DLL before and perhaps even written a service or two. I casually mention features such as thread local storage and assume that you know what I'm talking about. If you're unsure of your ability in this area, my favorite book on the subject is Advanced Windows, by Jefferey Richter (as of this writing the fourth edition is hot off the press).
In the COM chapter (Chapter 9), I assume you feel comfortable with the basics of IUnknown and that you know what a proxy and stub are. If you're unsure, my favorite COM book is Essential COM by Don Box.
Much of the later material in the COM chapter talks about COM+ features in Windows 2000, which Essential COM doesn't address (as of this writing, Essential COM is in its first edition). My favorite COM+ book in print as I write this is Programming Distributed Applications with COM and Visual Basic 6.0 by Ted Pattison. Tim Ewald's book Transactional COM+: Designing Scalable Applications will likely be a must-read as well, although it's not yet gone to press as I write this.
Although this book often shows full declarations of Windows API functions, I won't always bother to tell you the details of what each and every parameter means if it's not relevant to the topic at hand. I hope you find that this book works well as a complement to the Windows API documentation, as opposed to a replacement for it.
How to Approach This Book
I know that most developers don't relish thinking about security issues, which is often why security ends up getting retrofitted into existing products (or left until the last minute in new products). Most of my students are really surprised to learn that security is actually quite an interesting topic, and they really enjoy sitting through DevelopMentor's security class. However, I'm aware that this is a self-selecting group; these folks have chosen to take the class, often because there is a distinct set of problems that they need to be able to solve, whether they like it or not. Whatever your predisposition is toward security, I designed this book to be readable front to back, but also to be readable in chunks.
Many people will buy this book because it contains (at least as of this writing) an exhaustive coverage of COM security, and will want to dive right in to the chapter on COM. However, you can't possibly understand COM security without having a basic understanding of the fundamentals, and no matter how much I urge folks to read chapter 4, there will be a large group of people who don't have the time for this. If it's you I'm describing, do spend the time to read the first three (very short) chapters of this book before you start diving into the nitty-gritty details of COM security. These chapters will help you develop a more intuitive feel for how Windows security works and why it works the way it does.
This Is Not a Cookbook
In the vein of my last book project, Effective COM (coauthored with Don Box, Tim Ewald, and Chris Sells), I've purposely avoided making this a cookbook that provides lots of code for you to cut and paste to solve a particular set of problems that you may or may not be faced with. Instead, this book is about helping you understand how things work. I'd love to see a Windows security cookbook written. I find that cookbooks increase my long-term productivity once I have a basic understanding of the topic at hand.
The code snippets in this book should all compile correctly. However, although some of them might be appropriate for cutting and pasting into your projects, be aware that a number of them exist solely to foster insight and understanding and will necessarily be a bit more abstract than what you'd expect to find in a cookbook.
The Bad Guys
Often I'll refer to the "bad guys" when I want to indicate someone who may be trying to break into your system either to do malicious damage, or just for fun. The bad guys are the folks that we want to keep out, and the good guys are folks that we want to let in. I actually borrowed the terms "good guys" and "bad guys" from one of my favorite security books, Network Security: Private Communication in a Public World (Kaufman, Perlman, and Speciner 1995).
Code Sample Conventions
All the code samples in this book were built using Visual C++ 6 with the Platform SDK for Windows 2000. Each snippet was compiled, and all functional samples were tested as well. This occurred before they were copied into the manuscript, so any syntax errors you find are likely printing errors. Download the code snippets from ...