1693
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
Effectiveness = High
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Network Sniffer Forced Path Execution
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review
(not inspections)
Effectiveness = High
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
Effectiveness = High
Automated Static Analysis
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Configuration Checker
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal
Methods / Correct-By-Construction
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
For outbound authentication: store passwords, keys, and other credentials outside of the code in
a strongly-protected, encrypted configuration file or database that is protected from access by all
outsiders, including other local users on the same system. Properly protect the key (CWE-320).
If you cannot use encryption to protect the file, then make sure that the permissions are as
restrictive as possible [REF-7]. In Windows environments, the Encrypted File System (EFS) may
provide some protection.
Phase: Architecture and Design
For inbound authentication: Rather than hard-code a default username and password, key, or
other authentication credentials for first time logins, utilize a "first login" mode that requires the
user to enter a unique strong password or key.
Phase: Architecture and Design
If the product must contain hard-coded credentials or they cannot be removed, perform access
control checks and limit which entities can access the feature that requires the hard-coded
credentials. For example, a feature might only be enabled through the system console instead of
through a network connection.
Phase: Architecture and Design
CWE Version 4.14
CWE-798: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials