687
Effectiveness = SOAR Partial
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host Application Interface Scanner Fuzz Tester Framework-based Fuzzer Forced
Path Execution Monitored Virtual Environment - run potentially malicious code in sandbox /
wrapper / virtual machine, see if it does anything suspicious
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source
Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Context-configured Source Code Weakness Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE
1028 standard) (can apply to requirements, design, source code, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the
attack surface by carefully mapping roles with data and functionality. Use role-based access
control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may
not protect against horizontal authorization, i.e., it will not protect a user from attacking others
with the same role.
Phase: Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may
be different than the access control checks that you apply to more generic resources such as
files, connections, processes, memory, and database records. For example, a database may
restrict access for medical records to a specific database user, but each record might only be
intended to be accessible to the patient and the patient's doctor.
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, consider using authorization
frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI
Access Control feature [REF-45].
Phase: Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the
server side on every page. Users should not be able to access any unauthorized functionality or
information by simply requesting direct access to that page. One way to do this is to ensure that
all pages containing sensitive information are not cached, and that all such pages restrict access
CWE Version 4.14
CWE-285: Improper Authorization
CWE-285: Improper Authorization