This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Cornucopia - Ecommerce Website - CR 5"

From OWASP
Jump to: navigation, search
 
Line 11: Line 11:
 
=== Technical Note: ===
 
=== Technical Note: ===
  
Crypotographic function errors always need to result in rejection. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
+
Cryptographic function errors always need to result in rejection. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.
  
 
NB: Unlike [[Cornucopia_-_Ecommerce_Website_-_CR|other cards in this suit]], CR 5 assumes that cryptographic functions are in place, however they do not correctly respond to errors.
 
NB: Unlike [[Cornucopia_-_Ecommerce_Website_-_CR|other cards in this suit]], CR 5 assumes that cryptographic functions are in place, however they do not correctly respond to errors.

Latest revision as of 20:37, 29 March 2016

Cornucopia - Ecommerce Website CR 5.png

Suit: Cryptography

Card/Value: 5

Description:

Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected).

Technical Note:

Cryptographic function errors always need to result in rejection. It is also useful to log (associated with the user's identity if possible) and flag these as possibly malicious activity for further analysis, or as input for application intrusion detection systems.

NB: Unlike other cards in this suit, CR 5 assumes that cryptographic functions are in place, however they do not correctly respond to errors.

References:

OWASP SCP OWASP ASVS OWASP AppSensor CAPEC SAFECODE
103 7.2 - 97 21
145 29



« Previous Card | Cryptography | Next Card »