Gary David Robinson at 10:58, 14 September 2014

2014-09-14T10:58:25Z

Gary David Robinson: Created page with "* Reduce by having all pages HTTPS ** Does this function/feature have to be available over HTTP? * Is the function available to non-authenticated users? * Does the function in..."

2014-09-07T20:44:48Z

Created page with "* Reduce by having all pages HTTPS ** Does this function/feature have to be available over HTTP? * Is the function available to non-authenticated users? * Does the function in..."

New page

* Reduce by having all pages HTTPS
** Does this function/feature have to be available over HTTP?
* Is the function available to non-authenticated users?
* Does the function invoke a backend task that could be used to deny other legitimate users?
** E.g. if the fn writes to a file, or sends an SMS, or causes a CPU intensive calculation, could an attacker write a script to call the fn many times per second and prevent legimate users access to that task?
* Does new code change the attack surface? Does it open new ports or accept new inputs? Could it be done in a way that does not increase the attack surface?
* Are searches controlled? Search is a risky operation as it typically queries the database for some criteria and returns the results, if attacker can inject SQL into query then they could access more data than intended
* Is important data stored separately from trivial data (in DB, file storage, etc)
* If file uploads are allowed, should they be authenticated? Is there rate limiting? Max file size? Virus checking?
* If you have admin users with high privilege, are their actions logged/tracked in such a way that they a) can't erase/modify the log and b) can't deny their actions?
** Are there any alarms or monitoring to spot if they are accessing sensitive data that they shouldn't be?
* Will changes be compatible with existing countermeasures, or security code, or will new code/countermeasures need to be developed?
* Is the change attempting to introduce some non-centralized security code module, instead of re-using or extending an existing security module?
* Is the change adding unnecessary user levels or entitlements that will complicate the attack surface.
* Is the change storing unnecessary PII or confidential data?
* Does application configuration cause the attack surface to vary greatly, and is that configuration simple to use and alert the administrator when the attack surface is being expanded?
* Could the change be done in a different way that would reduce the attack surface, i.e instead of making help items searchable and storing help item text in a database table beside the main username/password store, providing static help text on HTML pages reduces the risk through the 'help' interface.

@@ Line 1: / Line 1: @@
-* Reduce by having all pages HTTPS
+= This is a draft version =
-** Does this function/feature have to be available over HTTP?
-* Is the function available to non-authenticated users?
+== Overview ==
-* Does the function invoke a backend task that could be used to deny other legitimate users?
-** E.g. if the fn writes to a file, or sends an SMS, or causes a CPU intensive calculation, could an attacker write a script to call the fn many times per second and prevent legimate users access to that task?
+The Attack Surface of an application is a description of the entry/exit points, the roles/entitlements of the users, and the sensitivity of the data held within the application.  For example, entry points such as login screens, HTML forms, file upload screens, all introduce a level of risk to the application.  Note that the code structure also forms part of the Attack Surface, in that the code checking authentication, or crypto, etc, is exercised by critical functions on the applications Attack Surface.
-* Does new code change the attack surface?  Does it open new ports or accept new inputs?  Could it be done in a way that does not increase the attack surface?
-* Are searches controlled?  Search is a risky operation as it typically queries the database for some criteria and returns the results, if attacker can inject SQL into query then they could access more data than intended
+== Description ==
 * Is important data stored separately from trivial data (in DB, file storage, etc)
-* If file uploads are allowed, should they be authenticated?  Is there rate limiting?  Max file size? Virus checking?
+This section concentrates on:
-* If you have admin users with high privilege, are their actions logged/tracked in such a way that they a) can't erase/modify the log and b) can't deny their actions?
+# knowing the current state of an applications Attack Surface and
-** Are there any alarms or monitoring to spot if they are accessing sensitive data that they shouldn't be?
+# understanding if a change is going to increase that Attack Surface.
 * Will changes be compatible with existing countermeasures, or security code, or will new code/countermeasures need to be developed?
 * Is the change attempting to introduce some non-centralized security code module, instead of re-using or extending an existing security module?
 * Is the change adding unnecessary user levels or entitlements that will complicate the attack surface.
-* Is the change storing unnecessary PII or confidential data?
+* If the change is storing PII or confidential data, is all of the new information absolutely necessary?  There is little value in increasing the risk to an application by storing the social security numbers of millions of people, if the data is never used.
 * Does application configuration cause the attack surface to vary greatly, and is that configuration simple to use and alert the administrator when the attack surface is being expanded?
 * Could the change be done in a different way that would reduce the attack surface, i.e instead of making help items searchable and storing help item text in a database table beside the main username/password store, providing static help text on HTML pages reduces the risk through the 'help' interface.

CRV2 ReducingAttSurf - Revision history

Gary David Robinson at 10:58, 14 September 2014

Gary David Robinson: Created page with "* Reduce by having all pages HTTPS ** Does this function/feature have to be available over HTTP? * Is the function available to non-authenticated users? * Does the function in..."