Test User Registration Process (OTG-IDENT-002) - Revision history

Jane O'Connor: Final edit

2014-05-14T14:32:47Z

Final edit

Andrew Muller at 16:40, 21 November 2013

2013-11-21T16:40:44Z

Andrew Muller at 16:33, 21 November 2013

2013-11-21T16:33:32Z

Andrew Muller at 15:03, 4 November 2013

2013-11-04T15:03:18Z

Andrew Muller: Created page with "== Summary == Some websites offer a user registration process that provisions a person with access. The identity requirements for access vary from positive identification to ..."

2013-07-28T14:35:27Z

Created page with "== Summary == Some websites offer a user registration process that provisions a person with access. The identity requirements for access vary from positive identification to ..."

New page

== Summary ==

Some websites offer a user registration process that provisions a person with access. The identity requirements for access vary from positive identification to none at all.

== Test objectives ==

Verify the identity requirements for user registration align with business requirements

Validate the registration process

== How to test ==

=== Example ===

== Tools ==

== References ==

== Remediation ==

@@ Line 3: / Line 3: @@
 == Summary ==
-Some websites offer a user registration process that automates (or semi-automates) the provisioning of people with system access. The identity requirements for access vary from positive identification to none at all, depending on the security requirements of the system. Many public applications completely automate the registration and provisioning process because the size of their userbase makes it impossible to manage manually. However, many corporate applications will provision users manually, so this test case may not apply.
+Some websites offer a user registration process that automates (or semi-automates) the provisioning of system access to users. The identity requirements for access vary from positive identification to none at all, depending on the security requirements of the system. Many public applications completely automate the registration and provisioning process because the size of the user base makes it impossible to manage manually. However, many corporate applications will provision users manually, so this test case may not apply.
 == Test objectives ==
-Verify the identity requirements for user registration align with business/security requirements
+#Verify that the identity requirements for user registration are aligned with business and security requirements.
 == How to test ==
-# Verify the identity requirements for user registration align with business/security requirements
+Verify that the identity requirements for user registration are aligned with business and security requirements:
-## Can anyone register for access?
+# Can anyone register for access?
-## Are registrations vetted by a human prior to provisioning, or are they automatically granted if the criteria are met?
+# Are registrations vetted by a human prior to provisioning, or are they automatically granted if the criteria are met?
-## Can the same person/identity register multiple times?
+# Can the same person or identity register multiple times?
-## Can users register for different roles/permissions?
+# Can users register for different roles or permissions?
-## What proof of identity is required for a registration to be successful?
+# What proof of identity is required for a registration to be successful?
-## Are registered identities verified?
+# Are registered identities verified?
 === Example ===
-In the Wordpress example below, the only identification requirement is an email address that is accessible to the registrant.
+In the WordPress example below, the only identification requirement is an email address that is accessible to the registrant.
 [[File:Wordpress_registration_page.jpg|700px]]
-In contrast, the Google example below, the identification requirements include name, DOB, country, mobile phone number, email address and CAPTCHA response. While only two of these can be verified (email address and mobile number), the identification requirements are stricter than Wordpress.
 [[File:Google_registration_page.jpg|700px]]
 == Tools ==
-HTTP Proxy
+A HTTP proxy can be a useful tool to test this control.
 == References ==
-[http://mashable.com/2011/06/09/user-registration-design/]
+[http://mashable.com/2011/06/09/user-registration-design/ User Registration Design]
 == Remediation ==
 Implement identification and verification requirements that correspond to the security requirements of the information the credentials protect.

← Older revision		Revision as of 16:40, 21 November 2013
Line 1:		Line 1:
		+	{{Template:OWASP Testing Guide v4}}
		+
	== Summary ==		== Summary ==

@@ Line 1: / Line 1: @@
 == Summary ==
-Some websites offer a user registration process that provisions a person with access. The identity requirements for access vary from positive identification to none at all.
+Some websites offer a user registration process that automates (or semi-automates) the provisioning of people with system access. The identity requirements for access vary from positive identification to none at all, depending on the security requirements of the system. Many public applications completely automate the registration and provisioning process because the size of their userbase makes it impossible to manage manually. However, many corporate applications will provision users manually, so this test case may not apply.
 == Test objectives ==
@@ Line 15: / Line 15: @@
 ## Are registrations vetted by a human prior to provisioning, or are they automatically granted if the criteria are met?
 ## Can the same person/identity register multiple times?
 ## What proof of identity is required for a registration to be successful?
 ## Are registered identities verified?
 # Validate the registration process
 === Example ===
 In the Wordpress example below, the only identification requirement is an email address that is accessible to the registrant.
-[[File:Wordpress_registration_page.jpg|800px]]
+[[File:Wordpress_registration_page.jpg|700px]]
 In contrast, the Google example below, the identification requirements include name, DOB, country, mobile phone number, email address and CAPTCHA response. While only two of these can be verified (email address and mobile number), the identification requirements are stricter than Wordpress.
-[[File:Google_registration_page.jpg|800px]]
+[[File:Google_registration_page.jpg|700px]]
 == Tools ==
 == References ==
 == Remediation ==
 Implement identification and verification requirements that correspond to the security requirements of the information the credentials protect.