You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/assets/YAML/default/Implementation/ApplicationHardening.yaml
+63-9Lines changed: 63 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -50,24 +50,78 @@ Implementation:
50
50
- Hardening is not explicitly covered by ISO 27001 - too specific
51
51
- 8.22
52
52
comments: ""
53
-
Contextualized Encoding:
53
+
Context-aware output encoding:
54
54
uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7
55
+
description: |
56
+
**Input validation** stops malicious data from entering your system. \
57
+
**Output encoding** neutralizes malicious data before rendering to user, or the next system.
58
+
59
+
Input validation and output encoding work together. Apply both.
60
+
61
+
**Context-aware output encoding** encodes data differently, depending on its context. In the sample below the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML.
62
+
63
+
```html
64
+
<div>{{bad_data}}</div>
65
+
<a href="{{bad_data}}">Click me</a>
66
+
<script>var x = '{{bad_data}}';</script>
67
+
<script>/** Comment {{bad_data}} */</script>
68
+
```
55
69
risk:
56
-
The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks.
70
+
If an attacker manages to slip though your input validation, the attacker may gain control over the user session or execute arbitrary actions.
57
71
measure: |
58
-
Implementing contextualized encoding for the next interpreter, such as employing object-relational mapping tools
59
-
or utilizing prepared statements, nearly removes the threat of injection vulnerabilities.
60
-
61
-
Also take into account a secure by default UI framework, which performs automatic contextual encoding of outputs with potential malicious user input (e.g. angular).
72
+
* Use modern secure frameworks such as React/Angular/Vue/Svelte. The default method here renders data in a safe way.
73
+
* Use established and well-maintained encoding libraries such as OWASP’s Java Encoder and Microsoft’s AntiXSS.
74
+
* Implement content security policies (CSP) to restrict the types of content that can be loaded and executed.
- Hardening is not explicitly covered by ISO 27001 - too specific
89
+
- 13.1.3
90
+
iso27001-2022:
91
+
- Hardening is not explicitly covered by ISO 27001 - too specific
92
+
- 8.22
93
+
comments: ""
94
+
Parametrization:
95
+
uuid: 00e91a8a-3972-4692-8679-674ab8547486
68
96
description: |
69
-
Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial.
70
-
implementation: []
97
+
By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well.
98
+
99
+
This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed.
100
+
101
+
Pay attention to these two lines of code. They seem similar, but behave very differently.
102
+
103
+
* `sql.execute("SELECT * FROM table WHERE ID = " + id);`
104
+
* `sql.execute("SELECT * FROM table WHERE ID = ?", id);`
105
+
The second line is parameterized. The same principle applies to other types, such as command line execution, etc.
106
+
risk: |
107
+
Systems vulnerable to injections may lead to data breaches, loss of data,
108
+
unauthorized alteration of data, or complete database compromise or downtime.
109
+
110
+
This applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.
111
+
measure: |
112
+
* Identify which of the types your application is using. Check that you use:
113
+
* Use _parametrized queries_ (or _prepared statements_)
114
+
* For database queries, you may also use:
115
+
* Use _stored procedures_ ()
116
+
* Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization
Copy file name to clipboardExpand all lines: src/assets/YAML/default/Implementation/InfrastructureHardening.yaml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -701,7 +701,7 @@ Implementation:
701
701
description: |
702
702
Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic.
0 commit comments