My Role(s) in DotNetNuke

This year I've been asked to take on the roles of Core Team Trustee / Security Manager. I'll not discuss the Trustee role too much as this details them well, but I'd like to chat about the Security Manager role a little.

The security manager role formalises what I've been doing in an informal fashion over the past few years. Some of my key responsibilities include :

• Regularly review the code for any potential issues introduced, or any that surface due to new/popular attack vectors.
• Act as 'point-man' for security related issues i.e.any mails directed to security@dotnetnuke.com. The emails we receive typically fall into a few categories
  • Reports of suspected hacks - from time to time people email in when their site has been hacked to see if the problem was dotnetnuke related. Typically I examine the exploit payload/vandalised pages, site contents and IIS logs and see if the issue was in the core or other 3rd party modules (note: almost without exception the hacks are not dotnetnuke related, typically they are server related usually due to missing windows patches)
  • Validate vulnerability assemements/penetration reports - sometimes we receive these when a site owner employs a 3rd party to assess their site. I read these, and validate whether the issues are genuine, if they have mitigating factors, and whether they can be fixed. In some cases genunine issues do turn up, at which point we fix the issue and release a bulletin as usual.
  • Users wanting answers to security related questions that they/clients require.
• Add to and maintain our security documentation (latest versions are available here)
• Perform security audits of any projects added to the project tracker. This has worked well, with a number of issues being caught before release already.
• Plan out security related enhancements. This year I'd like to look at a few areas including :
  • adding page level SSL support
  • enhancing security options in the core
  • breaking out our InputFilters into a provider, so that admins can plug in updates/alternatives easily (diversity is always a plus in the security world)
  • now we've moved to a pure asp.net 2.0 codebase, theres a number of 2.0 specific enhancements that will be added in the next releases.
  • adding an application level filter that can block user access based on selected criteria such as user agent or IP.