How to increase security on an ASP.NET site?

Question

I have an ASP.NET site, and some clients want a better level of security to access it. Today the site asks for a username and password, but many customers want to restrict access to some machines, and I need to do this on my server side. So, I ask for advice.

• Use VPN to restrict access? (Will not work with mobile devices)

• Can I check the mac address?

• Can I use a client certificate?

Answer 1

Easiest for user

I would consider (what Andrew Walters comment refers to) with all the content transmitted over SSL, and additional attention to them like page timeout, session commit, password policies, etc.

The PIN code delivered to your cell phone is a commonly used second factor.

I argue that this is "easiest for the user" because so many large sites (like Google and Facebook, their bank) work this way. There is nothing to install and nothing new to learn.

This is not very desirable from a business point of view.

VPN

Use VPN to restrict access? (Will not work with mobile devices)

This is a common option in corporate environments and is generally considered secure (although this is not an excuse for abandoning other good practices, such as password policies). However, you have options for mobile devices.

See the F5 SSL VPN , in particular their technical documentation on mobile access for iOS and Android , which says: “The BIG-IP Edge Portal for iOS and Android devices makes it easy for mobile users to access corporate web applications [...] securely access internal web pages and web applications. "

You can increase security by adding another factor to the authentication process: a token with an ever-changing PIN .

Certifications

Can I use a client certificate?

Yes it is possible ; whether it suits your business needs is another matter (for example, it takes time / skill / time to manage such a solution).

If you are not familiar with the subject, I suggest reading this article in KB article (quick read).

For implementation, here is an old but very detailed walkthrough and a new walkthrough for IIS 7.

Answer 2

If you want to block access to certain machines, use IIS http://www.iis.net/downloads/microsoft/dynamic-ip-restrictions . Indicate which IPs have access> make sure you set them to static in dhcp. This is the “need-based approach” used by payroll providers and credit card companies in IIS.

Answer 3

1) Use VPN to restrict access?

Will definitely work. It limits the machines with which you can work.

2) Can I check the MAC address?

This, but this is not a safe method, as MAC addresses can be tampered with.

3) Can I use a client certificate?

This may be your best bet indeed.