Security for applications in .NET – 5 tips to follow right now

When programming one of the aspects that we must take into account is the security of our code, from ByteHide we want to give you these 5 tips to increase the security for applications.

From ByteHide we want to give you some basic advice so that you start paying attention to the security of the code you program.

As we mentioned before, these are basic aspects that any programmer could start to implement today, in this blog you have more articles with solutions and security tips for more advanced .NET applications.

Avoid direct connections with databases of your applications

Many times our applications require databases, the easiest way to use these databases is to use a connector from our application.

In this example of a C # application in .NET we will show the MySqlConnection connector.

To make a connection we would use a code like this:

Loading code snippet...

This may be practical for simplicity, but it is not practical for security.

In this way we are exposing our server, port, username and password to anyone who has access to the application.

What solutions can we adopt?

What solutions can we adopt?

Here we must take into account several aspects, one of them how our application is structured and its needs.

In a simple way we could apply the following measures:

• Do not use Universal Data Link (UDL) files.
• Encrypt configuration files.
• Use Windows Authentication.
• Use Azure Key Vault Secret.

If we need complete and advanced security, we recommend outsourcing the connections.

We are going to continue with these tips to increase the security of the applications.

Data encryption to increase security in your applications

Every time we work with data, whether it is application settings or information about users, we must keep the data encrypted at all times.

For example, if you store files with information they should not be in plain text, here is a basic solution to solve the problem.

With this class you can manipulate files with a little more security, for example:

Loading code snippet...

This is a small example to start integrating security and encryption in the data that our application handles, both files and chains, connections, documents, and so on.

In this example we have seen that the password “SecurePassword1234” is in the code at a glance, that should not be the case, the best option would be to externalize this password and load it safely, as we did for example with mySql connection strings using Azure Key Vault Secret.

Use the security data protection API in ASP.NET Core in your applications

In ASP .NET Core we could use IDataProtector to protect the information and documents that we manipulate in our applications.

This method is very easy to implement and has several features that make it really good.

Here we provide you with a solution to help you implement this class in a simple way.

In order to use it in the StartUp.cs class of our ASP .NET Core application in the ConfigureServices method we will add:

Loading code snippet...

Then we will load it as a parameter in the constructor of the classes in which we want to implement it, then we can use it to encrypt the information, for example:

Loading code snippet...

Only with these measures will our application be much more secure, now we need to implement it correctly to ensure the safety of our customers.

Update dependencies and external libraries to improve the security of your applications

This recommendation may be obvious, but not many people take it into account, when we program in .NET we make use of many libraries, normally many of them offered by Microsoft, others developed by users or companies, like most of the NUGET packages.

It is important that we check which libraries our application is using and inform ourselves about known vulnerabilities or possible security risks that they may cause.

It is also important to take into account the versions of the framework that we are using for our application, since it could have been obsolete and without maintenance and could pose a security risk for your applications.

.NET Framework

Here we provide you with information about the current framework versions:

You can check the information here: https://docs.microsoft.com/es es/dotnet/framework/migration-guide/versions-and-dependencies

.NET Core

Versions of .NET Core available for download:

You can check the versions here: https://dotnet.microsoft.com/download/dotnet-core

.NET Standard

Here you have more information: https://docs.microsoft.com/es-es/dotnet/standard/net-standard

In addition, a table with the known vulnerabilities of the most common .NET libraries:

Use security systems and code obfuscation

One of the most effective and simple solutions is to use a tool that is responsible for protecting your application.

The aforementioned good security practices are important to keep your .NET application secure but they are not enough to guarantee the integrity of the methods, connections and other vulnerabilities.

At ByteHide we offer you the possibility to protect your applications for free and we provide you with more advanced protections and features so that you can adapt security to the needs of your applications.

Advantages of using a security system for .NET:

• Avoid wasting time protecting your applications.
• Does not require security knowledge.
• Allows the use of various protections and features.
• Incorporate the latest security techniques into your application with a couple of clicks.
• Detects and fixes vulnerabilities automatically.
• It allows you to focus on development and continuous integration without worrying about security, since it will be on your side.

And other advantages that a security system makes you save time and money with the publication of your software.

Another important aspect is that the performance of team development can be greatly reduced if we implement protection manually because every time there is an update we will have to protect the application again and development can become very tedious because the code is more difficult to understand. , less practical and less optimal.

In addition, many of the protections that we can manually incorporate are at the level of connections, file manipulation, encryption and good practices in development, but for the software to be secure and to guarantee the integrity of our intellectual property it is necessary to use methods and more advanced algorithms.

For example, ByteHide offers protections such as:

• Control Flow: which modifies the flow of the methods so that it cannot be represented.
• Protection of constants: That encrypts and protects the application constants so that sensitive information cannot be obtained.
• Renown: Which is responsible for renaming all the types, classes, methods and variables of our application so that the operation cannot be understood.

We hope this article has been helpful to you, and we invite you to start protecting your applications for free and with a couple of clicks.