05 application security fundamentals - part 2 - security mechanisms - authorization
- 1. AUTHORIZATION Security Mechanism: Authentication Authorization Session Management Data Validation Error Handling Logging Encryption
- 2. Authorization Core Concepts Is the user allowed to perform this action, within this context? 1st 2nd Should the user be allowed this function at all? Should the user have only limited context access?
- 3. Authorization Words to Live By Every function (page) must verify authorization to access Every function (page) must verify the access context Any client/server application must verify security on server
- 4. Authorization Words to Live By: #1 The problem – When access control checks are not applied consistently (or not at all) users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution. Every function (page) must verify authorization to access
- 5. Real World Example – CuteFlow Exploit
- 6. Authorization Words to Live By: #2 The problem – The system's access control functionality does not prevent one user from gaining access to another user's records by modifying the key value identifying the record. Every function (page) must verify access context
- 7. Real World Example – Fidelity Canada Usually, when users can directly access a PDF or other non-code file from the web server, (e.g., resource is located in the web root) there is no opportunity for authorization code to execute. With a predictable structure to the filename, it only takes minutes to create a script capable of retrieving all of the statements/reports on the site! Sullivan, B. (2002, May 30). Glitch at Fidelity Canada exposes customer info. Retrieved June 3, 2010, from http://www.itworldcanada.com/news/glitch-at-fidelity-canada-exposes-customer-info/124086
- 8. Authorization Words to Live By: #3 The problem – The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. An attacker can modify the client-side behavior to bypass the protection mechanisms. Any client/server application must verify security on the server
- 9. Real World Example – PayPal & Vendor Issue