Improving Web Application Security: Threats and - CGISecurity

112 Part II:Designing Secure Web ApplicationsTable 5.3 Common Authorization VulnerabilitiesVulnerabilityImplicationsReliance on a single gatekeeperIf the gatekeeper is bypassed or is improperlyconfigured, a user gains unauthorized access.Failing to lock down system resourcesagainst application identitiesFailing to limit database access tospecified stored proceduresInadequate separation of privilegesAn attacker can coerce the application into accessingrestricted system resources.An attacker mounts a SQL injection attack to retrieve,manipulate, or destroy data.There is no accountability or ability to perform per userauthorization.Review the following questions to help validate the authorization strategy of yourapplication design:● How do you authorize end users?● How do you authorize the application in the database?●How do you restrict access to system-level resources?How Do You Authorize End Users?You should consider authorization from two perspectives at design time. First,consider end-user authorization. Which users can access which resources andperform which operations? Secondly, how do you prevent malicious users from usingthe application to access system level resources? Review the following questions tovalidate the authorization strategy of your application:● Do you use a defense in depth strategy?Make sure that your design does not rely on a single gatekeeper to enforce accesscontrol. Consider what happens if this gatekeeper fails or if an attack manages tobypass it.● Which gatekeepers are used?Options include IIS Web permissions, NTFS permissions, ASP.NET fileauthorization (which applies only with Windows authentication), URLauthorization, and principal permission demands. If certain types are not used,make sure you know the reasons why not.● Do you use a role-based approach?If so, how are the role lists maintained and how secure are the administrationinterfaces that are required to do this?● Do your roles provide adequate privilege separation?Does your design provide the right degree of granularity so that the privilegesthat are associated with distinct user roles are adequately separated? Avoidsituations where roles are granted elevated privileges just to satisfy therequirements of certain users. Consider adding new roles instead.