Test Permissions of Guest/Training Accounts (OTG-IDENT-006) - Revision history

Andrew Muller at 16:41, 21 November 2013

2013-11-21T16:41:29Z

Andrew Muller at 14:39, 5 November 2013

2013-11-05T14:39:54Z

Andrew Muller: Created page with "== Summary == Guest and Training accounts are useful ways to acquaint potential users with system functionality prior to them completing the authorisation process required fo..."

2013-11-05T14:35:46Z

Created page with "== Summary == Guest and Training accounts are useful ways to acquaint potential users with system functionality prior to them completing the authorisation process required fo..."

New page

== Summary ==

Guest and Training accounts are useful ways to acquaint potential users with system functionality prior to them completing the authorisation process required for access. However, these accounts are often modeled on business roles and may be provisioned with access to more functionality than is required for the user.

== Test objectives ==

Evaluate consistency between access policy and guest/training account access permissions

== How to test ==

=== Example ===

<insert some images of guest/training account instances>

== Tools ==

== References ==

== Remediation ==

Ensure the application returns consistent generic error messages in response to invalid account name, password or other user credentials entered during the login process.

Ensure default system accounts and test accounts are deleted prior to releasing the system into production (or exposing it to an untrusted network).

← Older revision		Revision as of 16:41, 21 November 2013
Line 1:		Line 1:
		+	{{Template:OWASP Testing Guide v4}}
		+
	== Summary ==		== Summary ==

@@ Line 7: / Line 7: @@
 Evaluate consistency between access policy and guest/training account access permissions
+Build or validate access control matrix including guest/training accounts
 == How to test ==
+Either with or without the help of the system developers/configurators, develop an guest/training account vs. permission matrix. The matrix should explore the permissions that assigned to guest/training accounts. If a matrix is provided with the application it should be validated by the tester, if it doesn't exist, the tester should generate it and determine whether the matrix satisfies the desired access policy for the application.
 === Example ===
@@ Line 25: / Line 25: @@
 == Remediation ==
-Ensure the application returns consistent generic error messages in response to invalid account name, password or other user credentials entered during the login process.
+Ensure guest/training accounts are provisioned with the minimum permissions required for users that are not formally authorised or trained to use the application.