Security in Windows Store apps

1. Security in Windows Store apps Josh Dunn Senior Program Manager 3-123

2. Agenda • Security and customer confidence • Avoiding optimistic mistakes • Choose capabilities carefully • Properly handling customer data • Q&A

3. Security and customer confidence • Customer confidence in apps is directly related to: Apps following secure coding practices Apps behaving in expected ways Apps respecting customers data • Customers should acquire apps without worry • Simple, common sense principles applied to app security protects customer confidence • Leverage principle of least privileges for app capabilities • Handling customer data responsibly • Customer confidence leads to worry-free app acquisition

4. Avoiding optimistic mistakes • Customers expect apps to be alive, dynamic, and deeply interactive • Meeting this expectation requires real time data, feeds, and content from cloud services • Trusting the cloud is an expression of optimism, and is the most common mistake • Two examples of “optimistic” code • With great flexibility comes great responsibility

5. Optimistic eval() • Demo #1

6. Optimistic execUnsafeLocalFunction() • Demo #2

7. Other optimistic thoughts • Not trust and then verify, but verify then trust • eval() and execUnsafeLocalFunction() are examples of several potential “optimistic” functions • Use of WinJS framework Designed for Windows Store apps Maintained by Microsoft Grows as Windows 8 grows • Use caution in “working around” issues in frameworks • If you do one thing, JSON.parse it

8. Chose capabilities carefully • Least privilege should be the rule • General vs. special use capabilities • Most commonly misunderstood capabilities Documents library Enterprise auth • Capabilities enable great experiences, but the least privilege model should always be applied

9. Least privilege is the rule • If you don’t need it, don’t use it • Capabilities increase the functionality of an app, but they also increase the potential for abuse • Be careful adding a capability to make something “work” • If you don’t need it, don’t use it (even if you think you’ll need it later!)

10. General capabilities vs. special use capabilities • Regardless of general or special, least privileges is the rule • General use capabilities expand app functionality to interact with libraries, networks, and devices • Special use capabilities are powerful (think admin) and have very precise purposes • General capabilities can be used by all; special capabilities are restricted to business accounts

11. Special capabilities: Documents library • The single most “over declared” capability • Documents library considerations Programmatic access to registered file extensions Not required for accessing files, or creating files in documents. Use the file picker Do not register for extensions unless you handle them

12. Special capabilities: Enterprise authentication • Enterprise authentication considerations Used for accessing Windows credentials to access enterprise resources programmatically Not required for one-off access; the file picker provides the prompt for credential challenge Not required for connected account functionality • Unless you’re an enterprise app, you don’t need it

13. Special capabilities: Shared user certificates • If you’re not a financial institution or an enterprise, you probably don’t need it • Shared user certificates considerations Enable access to software and hardware certificates, such as certificates stored on a smart card Typically used by financial institutions or enterprise apps that require a smart card for authentication Not required for Secure Sockets Layer (SSL). The platform supports this natively

14. Properly handling customer data responsibly • Providing a customer-centric experience can mean handling customer data. They’re trusting you • Be transparent with your customers through your privacy policy What data do we collect? What we do with your data? How can I opt out of data collection? • Transmit/Store PII securely • Use non PII whenever possible Consider using GetPackageSpecificToken • Leverage Credentials Locker for credential management and access

15. Confidence is evaluated cumulatively • Confidence stems from expected app behavior, good coding practices, and proper data handling • By coding securely, applying least privileges, and handling customer data safely, your app can be layered in protection, not a cascading failure

16. Customer confidence leads to worry free app acquisition. Common sense coding, a least privilege approach to capabilities, and trustworthy handling of data will collectively ensure an app’s success

17. Resources • Best practices for writing safe and secure Windows Store apps using HTML5 • Coding with confidence • Capabilities List • getPackageSpecficToken

18. Thank you!

19. Resources • Develop: http://msdn.microsoft.com/en-US/windows/apps/br229512 • Design: http://design.windows.com/ • Samples: http://code.msdn.microsoft.com/windowsapps/Windows-8-Modern-Style-App-Samples • Videos: http://channel9.msdn.com/Windows Please submit session evals by using the Build Windows 8 app or at http://aka.ms/BuildSessions