Verify that all events that include untrusted data 8.5 will not execute as code in the intended log 1.0 viewing software. Verify that security logs are protected from 8.6 1.0 unauthorized access and modification. Verify that the application does not log sensitive data as defined under local privacy laws or regulations, organizational sensitive data as 8.7 defined by a risk assessment, or sensitive 3.0 authentication data that could assist an attacker, including user’s session identifiers, passwords, hashes, or API tokens. Verify that all non-printable symbols and field 8.8 separators are properly encoded in log entries, to 2.0 prevent log injection. Verify that log fields from trusted and untrusted 8.9 2.0 sources are distinguishable in log entries. Verify that an audit log or similar allows for 3.0 8.10 of key transactions. Verify that security logs have some form of 8.11 integrity checking or controls to prevent 3.0 unauthorized modification. Verify that the logs are stored on a different 8.12 partition than the application is running with 3.0 proper log rotation. Time sources should be synchronized to ensure 8.13 3.0.1 logs have the correct time References For more information, please see: OWASP Testing Guide 4.0 content: Testing for Error Handling
8.5 Verify that all events that include untrusted data will not execute as code in the intended log viewing software. 1.0 8.6 Verify that security logs are protected from unauthorized access and modification. 1.0 8.7 Verify that the application does not log sensitive data as defined under local privacy laws or regulations, organizational sensitive data as defined by a risk assessment, or sensitive authentication data that could assist an attacker, including user’s session identifiers, passwords, hashes, or API tokens. 3.0 8.8 Verify that all non-printable symbols and field separators are properly encoded in log entries, to prevent log injection. 2.0 8.9 Verify that log fields from trusted and untrusted sources are distinguishable in log entries. 2.0 8.10 Verify that an audit log or similar allows for of key transactions. 3.0 8.11 Verify that security logs have some form of integrity checking or controls to prevent unauthorized modification. 3.0 8.12 Verify that the logs are stored on a different partition than the application is running with proper log rotation. 3.0 8.13 Time sources should be synchronized to ensure logs have the correct time 3.0.1 References For more information, please see: OWASP Testing Guide 4.0 content: Testing for Error Handling