1640
Example 1:
The example below shows a configuration for the service security audit feature in the Windows
Communication Foundation (WCF).
Example Language: XML (Bad)
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="NewBehavior">
<serviceSecurityAudit auditLogLocation="Default"
suppressAuditFailure="false"
serviceAuthorizationAuditLevel="None"
messageAuthenticationAuditLevel="None" />
...
</system.serviceModel>
The previous configuration file has effectively disabled the recording of security-critical events,
which would force the administrator to look to other sources during debug or recovery efforts.
Logging failed authentication attempts can warn administrators of potential brute force attacks.
Similarly, logging successful authentication events can provide a useful audit trail when a legitimate
account is compromised. The following configuration shows appropriate settings, assuming that the
site does not have excessive traffic, which could fill the logs if there are a large number of success
or failure events (CWE-779).
Example Language: XML (Good)
<system.serviceModel>
<behaviors>
<serviceBehaviors>
<behavior name="NewBehavior">
<serviceSecurityAudit auditLogLocation="Default"
suppressAuditFailure="false"
serviceAuthorizationAuditLevel="SuccessAndFailure"
messageAuthenticationAuditLevel="SuccessAndFailure" />
...
</system.serviceModel>
Example 2:
In the following Java example the code attempts to authenticate the user. If the login fails a
retry is made. Proper restrictions on the number of login attempts are of course part of the retry
functionality. Unfortunately, the failed login is not recorded and there would be no record of an
adversary attempting to brute force the program.
Example Language: Java (Bad)
if LoginUser(){
// Login successful
RunProgram();
} else {
// Login unsuccessful
LoginRetry();
}
It is recommended to log the failed login action. Note that unneutralized usernames should not be
part of the log message, and passwords should never be part of the log message.
Example Language: Java (Good)
if LoginUser(){
// Login successful
CWE Version 4.14
CWE-778: Insufficient Logging
CWE-778: Insufficient Logging