Authorization 7
Implement least privilege, and restrict users to only the functionality, objects and properties that are required to perform their tasks.
NB: the key concept for this card is applying function/object/property authorization controls. See AZ 5 for resource type controls, and AZ 6 for data controls.
Yuanjing can access application functions, objects, or properties he is not authorized to access
Mappings
Owasp ASVS (4.0): 4.1.3 ,4.2.1
Capec: 122
Owasp SCP: 81,85,86,131
Owasp Appsensor: ACE1-4
Safecode: 8,10,11
ASVS (4.0) Cheatsheetseries Index
ASVS V4.1 - General Access Control Design
ASVS V4.2 - Operation Level Access Control
Attacks
Password Guessing/Brute Force Attacks
Session Hijacking (Man-in-the-Middle)
Loading comments 0%
