Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model 4 5 6 7 Cornucopia Cornucopia Cornucopia Cornucopia Keith can perform an action and Larry can influence the trust Aaron can bypass controls Mwengu's actions cannot be it is not possible to attribute it to other parties including users have because error/exception handling investigated because there is not him in the application, or abuse that is missing, or is implemented an adequate accurately trust elsewhere (e.g. in another inconsistently, or is partially record of security application) implemented, or does not deny events, or there is not a full audit access by default (i.e. errors trail, or these can be altered or terminate access/execution), or deleted by Mwengu, or there is relies on handling by some other no centralized logging service service or system 8 9 10 J Cornucopia Cornucopia Cornucopia Cornucopia David can bypass the application Michael can bypass the Xavier can circumvent the Roman can exploit the to gain access to data because the application to gain access to data application's controls because application because it was network and host infrastructure, because administrative tools or code frameworks, libraries and compiled using out-of-date tools, and supporting administrative interfaces are not components contain malicious or its configuration is not secure services/applications, have not secured adequately code or vulnerabilities (e.g. by default, or security been securely configured, the commercial off the shelf, information was not documented configuration rechecked outsourced, open source, and passed on to operational periodically and security patches externally-located) teams applied, or the data is stored locally, or the data is not physically protected
Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model Cornucopia 4 Cornucopia 5 Cornucopia 6 Cornucopia 7 Keith can perform an action and it is not possible to attribute it to him Larry can influence the trust other parties including users have in the application, or abuse that trust elsewhere (e.g. in another application) Aaron can bypass controls because error/exception handling is missing, or is implemented inconsistently, or is partially implemented, or does not deny access by default (i.e. errors terminate access/execution), or relies on handling by some other service or system Mwengu's actions cannot be investigated because there is not an adequate accurately record of security events, or there is not a full audit trail, or these can be altered or deleted by Mwengu, or there is no centralized logging service Cornucopia 8 Cornucopia 9 Cornucopia 10 Cornucopia J David can bypass the application to gain access to data because the network and host infrastructure, and supporting services/applications, have not been securely configured, the configuration rechecked periodically and security patches applied, or the data is stored locally, or the data is not physically protected Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately Xavier can circumvent the application's controls because code frameworks, libraries and components contain malicious code or vulnerabilities (e.g. commercial off the shelf, outsourced, open source, externally-located) Roman can exploit the application because it was compiled using out-of-date tools, or its configuration is not secure by default, or security information was not documented and passed on to operational teams
20130918180557%21OWASP-Cornucopia-Ecommerce_Website.docx