1783
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source
Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal
Methods / Correct-By-Construction
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the
attack surface by carefully mapping roles with data and functionality. Use role-based access
control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this
approach may not protect against horizontal authorization, i.e., it will not protect a user from
attacking others with the same role.
Phase: Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks
may be different than the access control checks that are applied to more generic resources such
as files, connections, processes, memory, and database records. For example, a database may
restrict access for medical records to a specific database user, but each record might only be
intended to be accessible to the patient and the patient's doctor [REF-7].
Phase: Architecture and Design
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, consider using authorization
frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI
Access Control feature [REF-45].
Phase: Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the
server side on every page. Users should not be able to access any unauthorized functionality or
information by simply requesting direct access to that page. One way to do this is to ensure that
all pages containing sensitive information are not cached, and that all such pages restrict access
to requests that are accompanied by an active and authenticated session token associated with
a user who has the required permissions to access that page.
Phase: System Configuration
Phase: Installation
Use the access control capabilities of your operating system and server environment and define
your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-862: Missing Authorization
CWE-862: Missing Authorization