Re: Fail Open Authentication and Parameter Injection

I think that Jeff's comments underpin the importance of reusing trusted security components across applications and externalizing security code from your application code where possible.

Frameworks like Jakarta Struts, for example, provide a nice way to leverage and implement trusted parameter checking code, and make the review process much easier by defining the control points for at least some of the form validation. Centralized application security architectures have a similar, but maybe more comprehensive goal, of removing the responsibility for authentication, access control, administration, and auditing from application code. Given the right structure, you could also automate some of your security policy authentication and access control rule testing.

Here's some recommended best practices from OpenHack 2002 that suggest some items to include in an application code security review:

   http://www.eweek.com/article2/0,3959,633780,00.asp

I think this list is synergistic with the OWASP Tom 10 vulnerability list.

Gary

Jeff Williams @ Aspect wrote:
> Great example! We see bizarre stuff like this all the time. The

-- 

Gary Gwin
http://www.cafesoft.com

*****************************************************************
*                                                               *
*   The Cafesoft Access Management System, Cams, is security    *
*   software that provides single sign-on authentication and    *
*   centralized access control for Apache, Tomcat, and custom   *
*   resources.                                                  *
*                                                               *
*****************************************************************

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek