|
|
| (12 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| − | A Guide to Building Secure Web Applications and
| + | {{taggedDocument |
| − | Web Services
| + | | type=historical |
| − | | + | | link=:Category:OWASP_Top_Ten_Project#tab=OWASP_Top_10_for_2013 |
| − | 2.1 (DRAFT 3)
| + | }} |
| − | February 2006
| |
| − | | |
| − | | |
| − |
| |
| − | | |
| | A Guide to Building Secure Web Applications and | | A Guide to Building Secure Web Applications and |
| | Web Services | | Web Services |
| Line 17: |
Line 12: |
| | OWASP Foundation | | OWASP Foundation |
| | | | |
| − | ===============Frontispiece ===============
| + | =Frontispiece = |
| | ==Dedication == | | ==Dedication == |
| − | To my fellow procrastinators and TiVo addicts, this book proves that given enough “tomorrows,” anything is possible. | + | ''To my fellow procrastinators and TiVo addicts, this book proves that given enough "tomorrows", anything is possible.'' -- Andrew van der Stock |
| − | Andrew van der Stock | + | |
| | ==Copyright and license == | | ==Copyright and license == |
| | © 2001 – 2006 OWASP Foundation. | | © 2001 – 2006 OWASP Foundation. |
| Line 34: |
Line 29: |
| | The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x: | | The Guide would not be where it is today without the generous gift of volunteer time and effort from many individuals. The following people helped develop Guide 2.x: |
| | | | |
| − |
| + | {| cellspacing="5" valign="top" |
| − | Abraham Kang | + | | |
| − | Adrian Wiesmann | + | * Abraham Kang |
| − | Amit Klein | + | * Adrian Wiesmann |
| − | Andrew van der Stock | + | * Amit Klein |
| − | Brian Greidanus | + | * Andrew van der Stock |
| − | Christopher Todd | + | * Brian Greidanus |
| − | Darrel Grundy | + | * Christopher Todd |
| − | Daniel Cornell | + | * Darrel Grundy |
| − | David Endler | + | * Daniel Cornell |
| − | Denis Pilipchuk | + | * David Endler |
| − | Dennis Groves | + | * Denis Pilipchuk |
| − | Derek Browne | + | | |
| − | Eoin Keary | + | * Dennis Groves |
| − | Erik Lee
| + | * Derek Browne |
| − | Ernesto Arroyo | + | * Eoin Keary |
| − | Frank Lemmon | + | * Erick Lee |
| − | Gene McKenna | + | * Ernesto Arroyo |
| − | Hal Lockhart | + | * Frank Lemmon |
| − | Izhar By-Gad | + | * Gene McKenna |
| − | Jeremy Poteet | + | * Hal Lockhart |
| − | José Pedro Arroyo | + | * Izhar By-Gad |
| − | K.K. Mookhey | + | * Jeremy Poteet |
| − | Kevin McLaughlin | + | | |
| − | Martin Eizner | + | * José Pedro Arroyo |
| − | Michael Howard | + | * K.K. Mookhey |
| − | Michael Scovetta | + | * Kevin McLaughlin |
| − | Mikael Simonsson | + | * Martin Eizner |
| − | Neal Krawetz | + | * Michael Howard |
| − | Nigel Tranter | + | * Michael Scovetta |
| − | Raoul Endres | + | * Mikael Simonsson |
| − | Ray Stirbei | + | * Neal Krawetz |
| − | Richard Parke | + | * Nigel Tranter |
| − | Robert Hansen | + | * Raoul Endres |
| − | Roy McNamara | + | | valign="top" | |
| − | Steve Taylor | + | * Ray Stirbei |
| − | Sverre Huseby | + | * Richard Parke |
| − | Tim Smith | + | * Robert Hansen |
| − | William Hau | + | * Roy McNamara |
| − |
| + | * Steve Taylor |
| | + | * Sverre Huseby |
| | + | * Tim Smith |
| | + | * William Hau |
| | + | |} |
| | + | |
| | ==Revision History == | | ==Revision History == |
| | | | |
| Line 108: |
Line 108: |
| | | | |
| | | | |
| | + | =Table of Contents = |
| | | | |
| − | | + | [[Guide:Table of Contents]] |
| − | ===============Table of Contents ===============
| |
| − | '''1''' '''ABOUT THE OPEN WEB APPLICATION SECURITY PROJECT 13'''
| |
| − | ===1.1 Structure and Licensing 13 ===
| |
| − | ===1.2 Participation and Membership 13 ===
| |
| − | ===1.3 Projects 14 ===
| |
| − | '''2''' '''INTRODUCTION 15'''
| |
| − | ===2.1 Developing Secure Applications 15 ===
| |
| − | ===2.2 Improvements in this edition 15 ===
| |
| − | ===2.3 How to use this Guide 16 ===
| |
| − | ===2.4 Updates and errata 16 ===
| |
| − | ===2.5 With thanks 16 ===
| |
| − | '''3''' '''WHAT ARE WEB APPLICATIONS? 17'''
| |
| − | ===3.1 Technologies 18 ===
| |
| − | ===3.2 First generation – CGI 18 ===
| |
| − | ===3.3 Filters 18 ===
| |
| − | ===3.4 Scripting 19 ===
| |
| − | ===3.5 Web application frameworks – J2EE and ASP.NET 20 ===
| |
| − | ===3.6 Small to medium scale applications 21 ===
| |
| − | ===3.7 Large scale applications 22 ===
| |
| − | ===3.8 View 22 ===
| |
| − | ===3.9 Controller 22 ===
| |
| − | ===3.10 Model 23 ===
| |
| − | ===3.11 Conclusion 24 ===
| |
| − | '''4''' '''POLICY FRAMEWORKS 25'''
| |
| − | ===4.1 Organizational commitment to security 25 ===
| |
| − | ===4.2 OWASP’s Place at the Framework table 26 ===
| |
| − | ===4.3 Development Methodology 28 ===
| |
| − | ===4.4 Coding Standards 29 ===
| |
| − | ===4.5 Source Code Control 29 ===
| |
| − | ===4.6 Summary 30 ===
| |
| − | '''5''' '''SECURE CODING PRINCIPLES 31'''
| |
| − | ===5.1 Asset Classification 31 ===
| |
| − | ===5.2 About attackers 31 ===
| |
| − | ===5.3 Core pillars of information security 32 ===
| |
| − | ===5.4 Security Architecture 32 ===
| |
| − | ===5.5 Security Principles 33 ===
| |
| − | '''6''' '''THREAT RISK MODELING 37'''
| |
| − | ===6.1 Threat Risk Modeling 37 ===
| |
| − | ===6.2 Performing threat risk modeling using the Microsoft Threat Modeling Process 37 ===
| |
| − | ===6.3 Alternative Threat Modeling Systems 44 ===
| |
| − | ===6.4 Trike 44 ===
| |
| − | ===6.5 AS/NZS 4360:2004 Risk Management 44 ===
| |
| − | ===6.6 CVSS 45 ===
| |
| − | ===6.7 OCTAVE 46 ===
| |
| − | ===6.8 Conclusion 47 ===
| |
| − | ===6.9 Further Reading 47 ===
| |
| − | '''7''' '''HANDLING E-COMMERCE PAYMENTS 49'''
| |
| − | ===7.1 Objectives 49 ===
| |
| − | ===7.2 Compliance and Laws 49 ===
| |
| − | ===7.3 PCI Compliance 49 ===
| |
| − | ===7.4 Handling Credit Cards 50 ===
| |
| − | ===7.5 Further Reading 53 ===
| |
| − | '''8''' '''PHISHING 55'''
| |
| − | ===8.1 What is phishing? 55 ===
| |
| − | ===8.2 User Education 56 ===
| |
| − | ===8.3 Make it easy for your users to report scams 57 ===
| |
| − | ===8.4 Communicating with customers via e-mail 57 ===
| |
| − | ===8.5 Never ask your customers for their secrets 58 ===
| |
| − | ===8.6 Fix all your XSS issues 58 ===
| |
| − | ===8.7 Do not use pop-ups 59 ===
| |
| − | ===8.8 Don’t be framed 59 ===
| |
| − | ===8.9 Move your application one link away from your front page 59 ===
| |
| − | ===8.10 Enforce local referrers for images and other resources 59 ===
| |
| − | ===8.11 Keep the address bar, use SSL, do not use IP addresses 60 ===
| |
| − | ===8.12 Don’t be the source of identity theft 60 ===
| |
| − | ===8.13 Implement safe-guards within your application 61 ===
| |
| − | ===8.14 Monitor unusual account activity 61 ===
| |
| − | ===8.15 Get the phishing target servers offline pronto 62 ===
| |
| − | ===8.16 Take control of the fraudulent domain name 62 ===
| |
| − | ===8.17 Work with law enforcement 63 ===
| |
| − | ===8.18 When an attack happens 63 ===
| |
| − | ===8.19 Further Reading 63 ===
| |
| − | '''9''' '''WEB SERVICES 64'''
| |
| − | ===Securing Web Services 64 ===
| |
| − | ===Communication security 65 ===
| |
| − | ===Passing credentials 65 ===
| |
| − | ===Ensuring message freshness 66 ===
| |
| − | ===Protecting message integrity 66 ===
| |
| − | ===Protecting message confidentiality 67 ===
| |
| − | ===Access control 67 ===
| |
| − | ===Audit 68 ===
| |
| − | ===Web Services Security Hierarchy 68 ===
| |
| − | ===SOAP 69 ===
| |
| − | ===WS-Security Standard 70 ===
| |
| − | ===WS-Security Building Blocks 72 ===
| |
| − | ===Communication Protection Mechanisms 78 ===
| |
| − | ===Access Control Mechanisms 80 ===
| |
| − | ===Forming Web Service Chains 82 ===
| |
| − | ===Available Implementations 83 ===
| |
| − | ===Problems 85 ===
| |
| − | ===Further Reading 87 ===
| |
| − | '''10''' '''AJAX AND OTHER “RICH” INTERFACE TECHNOLOGIES 5'''
| |
| − | ===10.1 Objective 5 ===
| |
| − | ===10.2 Platforms Affected 5 ===
| |
| − | ===10.3 Architecture 5 ===
| |
| − | ===10.4 Access control: Authentication and Authorization 5 ===
| |
| − | ===10.5 Silent transactional authorization 5 ===
| |
| − | ===10.6 Untrusted or absent session data 5 ===
| |
| − | ===10.7 State management 5 ===
| |
| − | ===10.8 Tamper resistance 5 ===
| |
| − | ===10.9 Privacy 5 ===
| |
| − | ===10.10 Proxy Façade 5 ===
| |
| − | ===10.11 SOAP Injection Attacks 5 ===
| |
| − | ===10.12 XMLRPC Injection Attacks 5 ===
| |
| − | ===10.13 DOM Injection Attacks 5 ===
| |
| − | ===10.14 XML Injection Attacks 5 ===
| |
| − | ===10.15 JSON (Javascript Object Notation) Injection Attacks 5 ===
| |
| − | ===10.16 Encoding safety 5 ===
| |
| − | ===10.17 Auditing 5 ===
| |
| − | ===10.18 Error Handling 5 ===
| |
| − | ===10.19 Accessibility 5 ===
| |
| − | ===10.20 Further Reading 5 ===
| |
| − | '''11''' '''AUTHENTICATION 108'''
| |
| − | ===11.1 Objective 108 ===
| |
| − | ===11.2 Environments Affected 108 ===
| |
| − | ===11.3 Relevant COBIT Topics 108 ===
| |
| − | ===11.4 Best Practices 108 ===
| |
| − | ===11.5 Common web authentication techniques 109 ===
| |
| − | ===11.6 Strong Authentication 111 ===
| |
| − | ===11.7 Federated Authentication 115 ===
| |
| − | ===11.8 Client side authentication controls 117 ===
| |
| − | ===11.9 Positive Authentication 118 ===
| |
| − | ===11.10 Multiple Key Lookups 120 ===
| |
| − | ===11.11 Referer Checks 122 ===
| |
| − | ===11.12 Browser remembers passwords 123 ===
| |
| − | ===11.13 Default accounts 124 ===
| |
| − | ===11.14 Choice of usernames 125 ===
| |
| − | ===11.15 Change passwords 126 ===
| |
| − | ===11.16 Short passwords 126 ===
| |
| − | ===11.17 Weak password controls 127 ===
| |
| − | ===11.18 Reversible password encryption 128 ===
| |
| − | ===11.19 Automated password resets 128 ===
| |
| − | ===11.20 Brute Force 130 ===
| |
| − | ===11.21 Remember Me 131 ===
| |
| − | ===11.22 Idle Timeouts 132 ===
| |
| − | ===11.23 Logout 132 ===
| |
| − | ===11.24 Account Expiry 133 ===
| |
| − | ===11.25 Self registration 134 ===
| |
| − | ===11.26 CAPTCHA 134 ===
| |
| − | ===11.27 Further Reading 135 ===
| |
| − | ===11.28 Authentication 136 ===
| |
| − | '''12''' '''AUTHORIZATION 148'''
| |
| − | ===12.1 Objectives 148 ===
| |
| − | ===12.2 Environments Affected 148 ===
| |
| − | ===12.3 Relevant COBIT Topics 148 ===
| |
| − | ===12.4 Best Practices 148 ===
| |
| − | ===12.5 Best Practices in Action 149 ===
| |
| − | ===12.6 Principle of least privilege 150 ===
| |
| − | ===12.7 Centralized authorization routines 152 ===
| |
| − | ===12.8 Authorization matrix 152 ===
| |
| − | ===12.9 Controlling access to protected resources 153 ===
| |
| − | ===12.10 Protecting access to static resources 153 ===
| |
| − | ===12.11 Reauthorization for high value activities or after idle out 154 ===
| |
| − | ===12.12 Time based authorization 154 ===
| |
| − | ===12.13 Be cautious of custom authorization controls 154 ===
| |
| − | ===12.14 Never implement client-side authorization tokens 155 ===
| |
| − | ===12.15 Further Reading 156 ===
| |
| − | '''13''' '''SESSION MANAGEMENT 157'''
| |
| − | ===13.1 Objective 157 ===
| |
| − | ===13.2 Environments Affected 157 ===
| |
| − | ===13.3 Relevant COBIT Topics 157 ===
| |
| − | ===13.4 Description 157 ===
| |
| − | ===13.5 Best practices 158 ===
| |
| − | ===13.6 Exposed Session Variables 159 ===
| |
| − | ===13.7 Page and Form Tokens 159 ===
| |
| − | ===13.8 Weak Session Cryptographic Algorithms 160 ===
| |
| − | ===13.9 Session Token Entropy 161 ===
| |
| − | ===13.10 Session Time-out 161 ===
| |
| − | ===13.11 Regeneration of Session Tokens 162 ===
| |
| − | ===13.12 Session Forging/Brute-Forcing Detection and/or Lockout 163 ===
| |
| − | ===13.13 Session Token Capture and Session Hijacking 163 ===
| |
| − | ===13.14 Session Tokens on Logout 165 ===
| |
| − | ===13.15 Session Validation Attacks 165 ===
| |
| − | ===13.16 PHP 166 ===
| |
| − | ===13.17 Sessions 166 ===
| |
| − | ===13.18 Further Reading 167 ===
| |
| − | ===13.19 Session Management 168 ===
| |
| − | '''14''' '''DATA VALIDATION 173'''
| |
| − | ===14.1 Objective 173 ===
| |
| − | ===14.2 Platforms Affected 173 ===
| |
| − | ===14.3 Relevant COBIT Topics 173 ===
| |
| − | ===14.4 Description 173 ===
| |
| − | ===14.5 Definitions 173 ===
| |
| − | ===14.6 Where to include integrity checks 174 ===
| |
| − | ===14.7 Where to include validation 174 ===
| |
| − | ===14.8 Where to include business rule validation 174 ===
| |
| − | ===14.9 Data Validation Strategies 175 ===
| |
| − | ===14.10 Prevent parameter tampering 177 ===
| |
| − | ===14.11 Hidden fields 178 ===
| |
| − | ===14.12 ASP.NET Viewstate 179 ===
| |
| − | ===14.13 URL encoding 182 ===
| |
| − | ===14.14 HTML encoding 182 ===
| |
| − | ===14.15 Encoded strings 183 ===
| |
| − | ===14.16 Data Validation and Interpreter Injection 183 ===
| |
| − | ===14.17 186 ===
| |
| − | ===14.18 Delimiter and special characters 186 ===
| |
| − | ===14.19 Further Reading 187 ===
| |
| − | '''15''' '''INTERPRETER INJECTION 188'''
| |
| − | ===15.1 Objective 188 ===
| |
| − | ===15.2 Platforms Affected 188 ===
| |
| − | ===15.3 Relevant COBIT Topics 188 ===
| |
| − | ===15.4 User Agent Injection 188 ===
| |
| − | ===15.5 HTTP Response Splitting 192 ===
| |
| − | ===15.6 SQL Injection 193 ===
| |
| − | ===15.7 ORM Injection 193 ===
| |
| − | ===15.8 LDAP Injection 194 ===
| |
| − | ===15.9 XML Injection 196 ===
| |
| − | ===15.10 Code Injection 196 ===
| |
| − | ===15.11 Further Reading 197 ===
| |
| − | ===15.12 SQL-injection 199 ===
| |
| − | ===15.13 Code Injection 202 ===
| |
| − | ===15.14 Command injection 202 ===
| |
| − | '''16''' '''CANONCALIZATION, LOCALE AND UNICODE 203'''
| |
| − | ===16.1 Objective 203 ===
| |
| − | ===16.2 Platforms Affected 203 ===
| |
| − | ===16.3 Relevant COBIT Topics 203 ===
| |
| − | ===16.4 Description 203 ===
| |
| − | ===16.5 Unicode 204 ===
| |
| − | ===16.6 http://www.ietf.org/rfc/rfc2279.txt?number=2279 206 ===
| |
| − | ===16.7 Input Formats 206 ===
| |
| − | ===16.8 Locale assertion 207 ===
| |
| − | ===16.9 Double (or n-) encoding 207 ===
| |
| − | ===16.10 HTTP Request Smuggling 208 ===
| |
| − | ===16.11 Further Reading 208 ===
| |
| − | '''17''' '''ERROR HANDLING, AUDITING AND LOGGING 210'''
| |
| − | ===17.1 Objective 210 ===
| |
| − | ===17.2 Environments Affected 210 ===
| |
| − | ===17.3 Relevant COBIT Topics 210 ===
| |
| − | ===17.4 Description 210 ===
| |
| − | ===17.5 Best practices 211 ===
| |
| − | ===17.6 Error Handling 211 ===
| |
| − | ===17.7 Detailed error messages 212 ===
| |
| − | ===17.8 Logging 213 ===
| |
| − | ===17.9 Noise 216 ===
| |
| − | ===17.10 Cover Tracks 216 ===
| |
| − | ===17.11 False Alarms 217 ===
| |
| − | ===17.12 Destruction 218 ===
| |
| − | ===17.13 Audit Trails 218 ===
| |
| − | ===17.14 Further Reading 219 ===
| |
| − | ===17.15 Error Handling and Logging 219 ===
| |
| − | '''18''' '''FILE SYSTEM 226'''
| |
| − | ===18.1 Objective 226 ===
| |
| − | ===18.2 Environments Affected 226 ===
| |
| − | ===18.3 Relevant COBIT Topics 226 ===
| |
| − | ===18.4 Description 226 ===
| |
| − | ===18.5 Best Practices 226 ===
| |
| − | ===18.6 Defacement 226 ===
| |
| − | ===18.7 Path traversal 227 ===
| |
| − | ===18.8 Insecure permissions 228 ===
| |
| − | ===18.9 Insecure Indexing 228 ===
| |
| − | ===18.10 Unmapped files 229 ===
| |
| − | ===18.11 Temporary files 229 ===
| |
| − | ===18.12 PHP 230 ===
| |
| − | ===18.13 Includes and Remote files 230 ===
| |
| − | ===18.14 File upload 232 ===
| |
| − | ===18.15 Old, unreferenced files 234 ===
| |
| − | ===18.16 Second Order Injection 234 ===
| |
| − | ===18.17 Further Reading 235 ===
| |
| − | ===18.18 File System 235 ===
| |
| − | '''19''' '''DISTRIBUTED COMPUTING 237'''
| |
| − | ===19.1 Objective 237 ===
| |
| − | ===19.2 Environments Affected 237 ===
| |
| − | ===19.3 Relevant COBIT Topics 237 ===
| |
| − | ===19.4 Best Practices 237 ===
| |
| − | ===19.5 Race conditions 237 ===
| |
| − | ===19.6 Distributed synchronization 237 ===
| |
| − | ===19.7 Further Reading 238 ===
| |
| − | '''20''' '''BUFFER OVERFLOWS 239'''
| |
| − | ===20.1 Objective 239 ===
| |
| − | ===20.2 Platforms Affected 239 ===
| |
| − | ===20.3 Relevant COBIT Topics 239 ===
| |
| − | ===20.4 Description 239 ===
| |
| − | ===20.5 General Prevention Techniques 240 ===
| |
| − | ===20.6 Stack Overflow 241 ===
| |
| − | ===20.7 Heap Overflow 242 ===
| |
| − | ===20.8 Format String 243 ===
| |
| − | ===20.9 Unicode Overflow 245 ===
| |
| − | ===20.10 Integer Overflow 246 ===
| |
| − | ===20.11 Further reading 247 ===
| |
| − | '''21''' '''ADMINISTRATIVE INTERFACES 249'''
| |
| − | ===21.1 Objective 249 ===
| |
| − | ===21.2 Environments Affected 249 ===
| |
| − | ===21.3 Relevant COBIT Topics 249 ===
| |
| − | ===21.4 Best practices 249 ===
| |
| − | ===21.5 Administrators are not users 250 ===
| |
| − | ===21.6 Authentication for high value systems 250 ===
| |
| − | ===21.7 Further Reading 251 ===
| |
| − | '''22''' '''CRYPTOGRAPHY 252'''
| |
| − | ===22.1 Objective 252 ===
| |
| − | ===22.2 Platforms Affected 252 ===
| |
| − | ===22.3 Relevant COBIT Topics 252 ===
| |
| − | ===22.4 Description 252 ===
| |
| − | ===22.5 Cryptographic Functions 253 ===
| |
| − | ===22.6 Cryptographic Algorithms 253 ===
| |
| − | ===22.7 Algorithm Selection 255 ===
| |
| − | ===22.8 Key Storage 256 ===
| |
| − | ===22.9 Insecure transmission of secrets 258 ===
| |
| − | ===22.10 Reversible Authentication Tokens 259 ===
| |
| − | ===22.11 Safe UUID generation 260 ===
| |
| − | ===22.12 Summary 260 ===
| |
| − | ===22.13 Further Reading 261 ===
| |
| − | ===22.14 Cryptography 261 ===
| |
| − | '''23''' '''CONFIGURATION 266'''
| |
| − | ===23.1 Objective 266 ===
| |
| − | ===23.2 Platforms Affected 266 ===
| |
| − | ===23.3 Relevant COBIT Topics 266 ===
| |
| − | ===23.4 Best Practices 266 ===
| |
| − | ===23.5 Default passwords 266 ===
| |
| − | ===23.6 Secure connection strings 267 ===
| |
| − | ===23.7 Secure network transmission 267 ===
| |
| − | ===23.8 Encrypted data 268 ===
| |
| − | ===23.9 PHP Configuration 268 ===
| |
| − | ===23.10 Global variables 268 ===
| |
| − | ===23.11 register_globals 269 ===
| |
| − | ===23.12 Database security 272 ===
| |
| − | ===23.13 Further Reading 273 ===
| |
| − | ===23.14 ColdFusion Components (CFCs) 273 ===
| |
| − | ===23.15 Configuration 274 ===
| |
| − | '''24''' '''SOFTWARE QUALITY ASSURANCE 281'''
| |
| − | ===24.1 Objective 281 ===
| |
| − | ===24.2 Platforms Affected 281 ===
| |
| − | ===24.3 Best practices 281 ===
| |
| − | ===24.4 Process 283 ===
| |
| − | ===24.5 Metrics 283 ===
| |
| − | ===24.6 Testing Activities 284 ===
| |
| − | '''25''' '''DEPLOYMENT 286'''
| |
| − | ===25.1 Objective 286 ===
| |
| − | ===25.2 Platforms Affected 286 ===
| |
| − | ===25.3 Best Practices 286 ===
| |
| − | ===25.4 Release Management 287 ===
| |
| − | ===25.5 Secure delivery of code 287 ===
| |
| − | ===25.6 Code signing 288 ===
| |
| − | ===25.7 Permissions are set to least privilege 288 ===
| |
| − | ===25.8 Automated packaging 288 ===
| |
| − | ===25.9 Automated deployment 289 ===
| |
| − | ===25.10 Automated removal 289 ===
| |
| − | ===25.11 No backup or old files 289 ===
| |
| − | ===25.12 Unnecessary features are off by default 289 ===
| |
| − | ===25.13 Setup log files are clean 289 ===
| |
| − | ===25.14 No default accounts 290 ===
| |
| − | ===25.15 Easter eggs 290 ===
| |
| − | ===25.16 Malicious software 291 ===
| |
| − | ===25.17 Further Reading 292 ===
| |
| − | '''26''' '''MAINTENANCE 294'''
| |
| − | ===26.1 Objective 294 ===
| |
| − | ===26.2 Platforms Affected 294 ===
| |
| − | ===26.3 Relevant COBIT Topics 294 ===
| |
| − | ===26.4 Best Practices 294 ===
| |
| − | ===26.5 Security Incident Response 295 ===
| |
| − | ===26.6 Fix Security Issues Correctly 295 ===
| |
| − | ===26.7 Update Notifications 296 ===
| |
| − | ===26.8 Regularly check permissions 296 ===
| |
| − | ===26.9 Further Reading 297 ===
| |
| − | ===26.10 297 ===
| |
| − | ===26.11 Maintenance 297 ===
| |
| − | '''27''' ''''''GNU FREE DOCUMENTATION LICENSE 301''''''
| |
| − | ===27.1 PREAMBLE 301 ===
| |
| − | ===27.2 APPLICABILITY AND DEFINITIONS 301 ===
| |
| − | ===27.3 VERBATIM COPYING 302 ===
| |
| − | ===27.4 COPYING IN QUANTITY 303 ===
| |
| − | ===27.5 MODIFICATIONS 303 ===
| |
| − | ===27.6 COMBINING DOCUMENTS 305 ===
| |
| − | ===27.7 COLLECTIONS OF DOCUMENTS 305 ===
| |
| − | ===27.8 AGGREGATION WITH INDEPENDENT WORKS 306 ===
| |
| − | ===27.9 TRANSLATION 306 ===
| |
| − | ===27.10 TERMINATION 306 ===
| |
| − | ===27.11 FUTURE REVISIONS OF THIS LICENSE 306 ===
| |
