Improving Web Application Security: Threats and - CGISecurity

64 Part I: Introduction to Threats and CountermeasuresRatings do not have to use a large scale because this makes it difficult to rate threatsconsistently alongside one another. You can use a simple scheme such as High (1),Medium (2), and Low (3).When you clearly define what each value represents for your rating system, it helpsavoids confusion. Table 3.6 shows a typical example of a rating table that can be usedby team members when prioritizing threats.Table 3.6 Thread Rating TableRating High (3) Medium (2) Low (1)D DamagepotentialLeaking sensitiveinformationThe attacker cansubvert the securitysystem; get full trustauthorization; run asadministrator; uploadcontent.Leaking trivialinformationR Reproducibility The attack can bereproduced every timeand does not require atiming window.E Exploitability A novice programmercould make the attackin a short time.A Affected users All users, defaultconfiguration, keycustomersD Discoverability Published informationexplains the attack. Thevulnerability is found inthe most commonlyused feature and isvery noticeable.The attack can bereproduced, but onlywith a timing windowand a particular racesituation.A skilled programmercould make the attack,then repeat the steps.Some users, nondefaultconfigurationThe vulnerability is in aseldom-used part ofthe product, and only afew users should comeacross it. It would takesome thinking to seemalicious use.The attack is verydifficult to reproduce,even with knowledge ofthe security hole.The attack requires anextremely skilledperson and in-depthknowledge every timeto exploit.Very small percentageof users, obscurefeature; affectsanonymous usersThe bug is obscure,and it is unlikely thatusers will work outdamage potential.After you ask the above questions, count the values (1–3) for a given threat. Theresult can fall in the range of 5–15. Then you can treat threats with overall ratings of12–15 as High risk, 8–11 as Medium risk, and 5–7 as Low risk.For example, consider the two threats described earlier:● Attacker obtains authentication credentials by monitoring the network.●SQL commands injected into application.