In this lecture, we explore secure code design practices from the perspective of a cloud solution architect at Microsoft. The speaker, Fred, expresses his passion for script file security due to past experiences and highlights the importance of secure coding practices in PowerShell. The lecture is structured to cover various fundamental aspects of secure code design.

Fred emphasizes the significance of deploying constrained language mode to prevent attackers from bypassing security measures. He stresses the need to avoid compromising systems and privileges and focuses on preventing attackers from circumventing security by exploiting poorly written code.

The lecture delves into specific topics such as the importance of securing secrets and privileges, advising against storing clear text credentials in scripts. Fred introduces tools like Export CLI XML and PowerShell's Secret Management module to securely handle credentials. He also discusses the use of Azure Key Vault for secure credential storage.

The speaker warns against using the invoke expression command, which allows for code execution from strings, potentially leading to security vulnerabilities. He demonstrates the risks associated with scope boundary violations and the implications of executing untrusted scripts in background run spaces.

Fred touches on the challenges of implementing code signing and provides guidance on ensuring code signing compliance. He introduces a tool for testing constrained language mode compatibility to assess script functionality in restricted environments.

The lecture concludes with practical tips for building secure PowerShell modules, emphasizing the importance of least privilege and role delegation. The speaker showcases tools like Just Enough Administration and Function Apps for implementing secure access controls in cloud environments. Fred encourages adopting secure coding practices to mitigate security risks and enhance overall script security.

Overall, the lecture serves as a comprehensive guide to implementing secure code design practices in PowerShell, offering insights, best practices, and practical solutions for enhancing script security and resilience against potential threats.

Chapters:
00:00:00 Secure Code Design Practices - Friedrich Weinmann - PSConfEU 2024
00:00:11 Introduction to Secure Code Design Practices
00:03:26 Fundamentals: Secrets and Privileges
00:11:13 Preventing Code Injection with Invoke-Expression
00:18:52 Scope Trespassing and Variable Scoping
00:26:04 Script Blocks and Language Mode Challenges
00:35:35 Implementing Trusted Data Validation
00:37:47 Importance of Code Signing and Compliance
00:43:33 Building Secure PowerShell Modules
00:44:23 Least Privilege Principle and Delegation Controls

свернуть