View source for Test user-viewable log of authentication events (OTG-LOG-002)

== Brief Description ==
Proving users with their last logged in date/time is a useful way to help them identify mis-use of their own accounts. Providing a list of important authentication events over a longer time period is even better.

== Issue ==
If visibility is given to users of applications with user interfaces (e.g. websites) about their previous use, this can provide them with confidence about the use of their account. If unexpected events are found, this might encouarge a user to change their password. If a number of users contact the application's owner, it could indicate a more significant intrusion or data breach.

== Example ==

A user logs in and goes to their profile page. There is a paginated list of recent site authentication actions, with the most recent first. For example:

 Tue, 15 Oct 2013, 14:43:05 GMT   Europe        Successful log in          User
 Tue, 15 Oct 2013, 14:40:37 GMT   N.America     Reset link sent            Application
 Tue, 15 Oct 2013, 14:40:36 GMT   SE.Asia       Account unlocked           Call centre [6RE34]
 Tue, 15 Oct 2013, 14:40:20 GMT   SE.Asia       Account details viewed     Call centre [6RE34]
 Tue, 15 Oct 2013, 14:40:20 GMT   Europe        Caller identity verified   +44 191 *** ****
 Tue, 15 Oct 2013, 14:21:15 GMT   N.America     Account locked             Application
 Tue, 15 Oct 2013, 14:21:15 GMT   Europe        Failed log in              User
 Tue, 15 Oct 2013, 14:21:06 GMT   Europe        Failed log in              User
 Tue, 15 Oct 2013, 14:20:53 GMT   Europe        Failed log in              User
 Mon, 29 Apr 2013, 19:54:09 GMT   Europe        Logged out                 User
 etc

== Testing Method ==
Log in as a valid user and identify if there is a list of account activity, especially authentication events such as:

* Successful log in
* Failed log in
* Account locked / disabled
* Account unlocked / enabled
* Account created
* Password changed
* Username changed
* Logged out

These should relate to all such actions:

* Using the web application itself (i.e. by the authenticated user)
* Using related/partner applications where the same credentials are valid
* By someone or something else (e.g. a call centre agent, a website administrator, another application)

Also review whether these additional properties relating to the user are accessible:

* Events that cost the user money (e.g. purchase history)
* Changes to role or access privileges
* Significant status changes (e.g. credit limit altered)

Ensure that sensitive data is not exposed in the event list.

== Test Tools ==

None. Use a web browser to log in and examine information available to the user themselves.

== Related Test Cases ==

None.

== References ==  

None.

== Remediation ==

Implement a list of account activity, viewable by the user after they have been authenticated. This provide the ability to look back over several months.