Teach your developers about access control vulnerabilities
Data extraction techniques are evolving day by day, so it’s not difficult to see why the significance of securing data is also growing rapidly. But what does access control mean, why is it important, and how can we use it to protect our data? Read on to find out!
What is Access Control?
Access control is a comprehensive group of methods that tries to guarantee security and prevent the unauthorized usage of resources, computers, data, and computer networks.
It is a fundamental component of data security, and it’s crucial to plan it at the very beginning of the project development lifecycle. It tries to answer questions such as:
- Who should access a company’s data?
- What kind of users should access specific data?
- What kind of access roles and privileges do we want in our application?
- How can we make sure users are granted access to the right resources?
- Under what circumstances do we deny access to a user with access privileges?
The main components of Access Control
As Daniel Crowley, head of research for IBM’s X-Force Red outlines, access control consists of two main components:
1. Authentication provides and validates identity. It’s the process of verifying that an individual, entity, or website is who it claims to be. Authentication in the context of web applications is commonly performed by submitting a username or an ID, and one or more items of private information that only a given user should know.
2. Authorization defines access rights and privileges to resources. This process determines whether a request to access a particular resource should be granted or not.
Attack vectors
Broken access control was the fifth most common vulnerability type in the OWASP Top 10 2017 list, and number one in OWASP Top 10 2021. Since this can be a massive security issue, prevention is crucial. There are several ways to detect access control flaws, source code analysis and vulnerability scanning being among them. We’ve gathered some of the subcategories of broken access control below, but there are many more. To dive deeper into what these are and how to prevent them, check out our blog post.
Direct object references
One of the most common access control related vulnerabilities is IDOR (Insecure Direct Object Reference), which means someone can access sensitive data they shouldn’t be able to see by referring to it directly. As a result, attackers can bypass authorization and access resources without the necessary permissions.
Mass assignment
Mass assignment refers to assigning values to multiple attributes all at once. If these values are coming from the user, the list of attributes should be validated properly, otherwise the attacker could set values of private properties as well.
Directory/path traversal
A directory traversal attack can happen due to improper filtering and validation of the user input. It refers to a security misconfiguration or vulnerability that can be exploited by a malicious user in a web application by appending the well-known dot-dot-slash (../) or other similar strings to file paths sent by the application to traverse up the server’s directories and access private system files.
Supply chain attack
To minimize risks coming from third-party software or software components, and to secure organizational data accessed by other companies, designing and cultivating adequate risk management related to the supply chain is essential. This involves both physical security and security for software, processes, and services.
Get started with secure coding training
On the Avatao platform we make it easy for you to find and assign exercises, and to track your developers’ progress on our interactive access control training modules. Reach out to our team today:
Follow us
Copyright © 2022 Avatao