Sebastien can easily identify user Javier can use default, test or Sven can reuse a temporary Cecilia can use brute force and names or can enumerate them easily guessable credentials to password because the user does dictionary attacks against one or authenticate, or can use an old not have to change it on first use, many accounts without limit, or account or an account not or it has too long or no expiry these attacks are simplified due to necessary for the application insufficient complexity, length, expiration and re-use requirements for passwords 8 9 10 J Authentication Authentication Authentication Authentication Kate can by bypass Claudia can undertake more Pravin can bypass authentication Mark can access resources or authentication because it does critical functions because controls because a centralized services because there is no not fail secure (i.e. it defaults to authentication requirements are standard, tested and approved authentication requirement, or it allowing access) too weak, or there is no authentication was assumed authentication requirement to re-authenticate module/framework/service, would be undertaken by some for these separate to the resource being other system, or was performed requested, is not being used in some previous action Q K
Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords Authentication 8 Authentication 9 Authentication 10 Authentication J Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because there is no authentication requirement, or it was assumed authentication would be undertaken by some other system, or was performed in some previous action Q K
20130603165545%21OWASP-Cornucopia-Ecommerce_Website.docx