Out-of-Band authentication mechanisms
V6.6.1
Verify that authentication mechanisms using the Public Switched Telephone Network (PSTN) to deliver One-time Passwords (OTPs) via phone or SMS are offered only when the phone number has previously been validated, alternate stronger methods (such as Time based One-time Passwords) are also offered, and the service provides information on their security risks to users. For L3 applications, phone and SMS must not be available as options.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 114, 115, 151, 50, 633
V6.6.2
Verify that out-of-band authentication requests, codes, or tokens are bound to the original authentication request for which they were generated and are not usable for a previous or subsequent one.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 114, 151, 50, 633
V6.6.3
Verify that a code based out-of-band authentication mechanism is protected against brute force attacks by using rate limiting. Consider also using a code with at least 64 bits of entropy.
Required for Level 2 and 3
Related CAPEC™ Requirements
V6.6.4
Verify that, where push notifications are used for multi-factor authentication, rate limiting is used to prevent push bombing attacks. Number matching may also mitigate this risk.
Required for Level 3
Related CAPEC™ Requirements
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
