Authentication (AT9)

The key concept is authentication levels and using them appropriately.

Scenario: Claudia's Access to Critical Functions

Imagine a situation where Claudia, exploiting insufficient authentication protocols, gains access to critical functions within a system. This occurs due to:

1. Weak Authentication Standards: The system lacks robust authentication methods, such as two-factor authentication (2FA), relying only on basic password entry.
2. Absence of Re-authentication: There's no requirement for users to re-authenticate or confirm their identity for accessing or performing sensitive or critical operations.

Example

Claudia discovers that a corporate network only requires standard password authentication for accessing all areas, including sensitive financial records and administrative controls. By obtaining a user's password, Claudia is able to access these critical areas without any additional authentication checks. The absence of 2FA or re-authentication steps for high-risk actions leaves the network vulnerable to unauthorized access and potential data breaches or manipulation.

Threat Modeling

STRIDE

This scenario falls under STRIDE: Spoofing.

Spoofing is impersonating a user or system without rightful credentials. Claudia uses weak authentication (password-only, no 2FA, no re-auth for critical functions) to impersonate legitimate users and gain access to high-value resources. The issue isn’t that the data is leaked by accident (Information Disclosure) or modified directly (Tampering), but that the system cannot strongly verify identity, making spoofing trivial.

What can go wrong?

This vulnerability can lead to unauthorized access to sensitive functions and data, posing a significant risk to the organization’s security and integrity.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

The level of assurance required for confirmation of identity should be assessed. In some cases different levels of authentication may be needed (e.g. two-factor authentication for some users, but not others), and re-authentication should be considered for some important functionality (e.g. changing password, making a payment, deleting an account), especially where weaknesses have been accepted to reduce application friction for users (e.g. having longer session timeouts, allowing guest check-out, having remember-me functionality).

1. Implement strong authentication methods like MFA for an added layer of security, particularly for critical functions.
2. Introduce re-authentication processes for accessing sensitive areas or performing high-risk operations.
3. Regularly review and update authentication protocols to ensure they align with the best practices and emerging security threats.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.