743
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Host Application Interface Scanner Fuzz Tester Framework-based Fuzzer
Effectiveness = SOAR Partial
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Focused Manual Spotcheck - Focused manual analysis of source Manual Source
Code Review (not inspections)
Effectiveness = SOAR Partial
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Source code Weakness Analyzer Context-configured Source Code Weakness
Analyzer
Effectiveness = SOAR Partial
Architecture or Design Review
According to SOAR, the following detection techniques may be useful: Highly cost effective:
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal
Methods / Correct-By-Construction Cost effective for partial coverage: Attack Modeling
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Divide the software into anonymous, normal, privileged, and administrative areas. Identify
which of these areas require a proven user identity, and use a centralized authentication
capability. Identify all potential communication channels, or other means of interaction with the
software, to ensure that all channels are appropriately protected. Developers sometimes perform
authentication at the primary channel, but open up a secondary channel that is assumed to
be private. For example, a login mechanism may be listening on one network port, but after
successful authentication, it may open up a second port where it waits for the connection, but
avoids authentication because it assumes that only the authenticated party will connect to the
port. In general, if the software or protocol allows a single session or user state to persist across
multiple connections or channels, authentication and appropriate credential management need to
be used throughout.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Architecture and Design
Where possible, avoid implementing custom authentication routines and consider using
authentication capabilities as provided by the surrounding framework, operating system, or
environment. These may make it easier to provide a clear separation between authentication
tasks and authorization tasks. In environments such as the World Wide Web, the line between
authentication and authorization is sometimes blurred. If custom authentication routines are
required instead of those provided by the server, then these routines must be applied to every
single page, since these pages could be requested directly.
Phase: Architecture and Design
CWE Version 4.14
CWE-306: Missing Authentication for Critical Function
CWE-306: Missing Authentication for Critical Function