Access Authorization Controls
– Use only trusted system objects for making access authorization decisions.
– Use a single site-wide component to check access authorization.
– Access controls should fail securely.
– Deny all access if the application cannot access its security configuration information.
– Enforce authorization controls on every request.
– Segregate privileged logic from other application code.
Resource Access Restrictions
– Restrict access to files or other resources to only authorized users.
– Restrict access to protected URLs to only authorized users.
– Restrict access to protected functions to only authorized users.
– Restrict direct object references to only authorized users.
– Restrict access to services to only authorized users.
– Restrict access to application data to only authorized users.
– Restrict access to user and data attributes and policy information used by access controls.
– Restrict access security-relevant configuration information to only authorized users.
– Server-side implementation and presentation layer representations of access control rules must match.
Client-Side Security Measures
– If state data must be stored on the client, use encryption and integrity checking on the server side to detect state tampering.
Enforcement of Business Rules
– Enforce application logic flows to comply with business rules.
– Limit the number of transactions a single user or device can perform.
– Use the “referer” header as a supplemental check only.
– Periodically re-validate a user’s authorization for long authenticated sessions.
– Implement account auditing and enforce the disabling of unused accounts.
– Support disabling of accounts and terminating sessions when authorization ceases.
Least Privilege Principle
– Service accounts or accounts supporting connections to or from external systems should have the least privilege possible.
Access Control Policy
– Create an Access Control Policy to document an application’s business rules, data types, and access authorization criteria and/or processes.