This project is read-only.


Category Vulnerabilities
Auditing and Logging * Failing to audit failed logons.
* Failing to secure log files.
* Storing sensitive information in log files.
* Failing to audit across application tiers.
* Failure to throttle log files.
Authentication * Broad distribution of Azure LiveID
* Failure to roll-over certificates
* Using weak passwords.
* Storing clear text credentials in configuration files.
* Passing clear text credentials over the network.
* Permitting prolonged session lifetime.
* Mixing personalization with authentication.
* Using weak authentication mechanisms (e.g., using basic authentication over an untrusted network).
Authorization * Relying on a single gatekeeper (e.g., relying on client-side validation only).
* Failing to lock down system resources against application identities.
* Failing to limit database access to specified stored procedures.
* Using inadequate separation of privileges.
* Connection pooling.
* Permitting over-privileged accounts.
Configuration Management * Using insecure custom administration interfaces.
* Failing to secure configuration files on the server.
* Storing sensitive information in the clear text.
* Having too many administrators.
* Using over-privileged process accounts and service accounts.
Exception Management * Failure to use structured exception handling (try/catch).
* Revealing too much information to the client.
* Failure to specify fault contracts with the client.
* Failure to use a global exception handler.
Impersonation/Delegation * Failure to revert to a lower privilege after using impersonation.
* Improper use of global impersonation across the entire service.
Message Encryption * Not encrypting messages.
* Using custom cryptography.
* Distributing keys insecurely.
* Managing or storing keys insecurely
Message Replay Detection * Failure to use a mechanism to detect message replays.
Message Signing * Not using either message or transport security.
Message Validation * Using non-validated input used to generate SQL queries.
* Relying only on client-side validation.
* Using input file names, URLs, or usernames for security decisions.
* Using application-only filters for malicious input.
* Looking for known bad patterns of input.
* Trusting data read from databases, file shares, and other network resources.
* Failing to validate input from all sources including cookies, Simple Object Access Protocol (SOAP) headers, SOAP parameters, databases, and network resources.
Sensitive Data * Storing secrets when you do not need to.
* Storing secrets in code.
* Storing secrets in clear text in files, registry, or configuration.
* Passing sensitive data in clear text over networks.
Session Management * Passing session IDs over unencrypted channels.
* Permitting prolonged session lifetime.
* Having insecure session state stores.
* Placing session identifiers in query strings

Last edited May 24, 2010 at 11:04 PM by paulenfield, version 1


No comments yet.