Kate can by bypass Claudia can undertake more Pravin can bypass authentication Mark can access resources or authentication because it does critical functions because controls because a centralized services because there is no not fail secure (i.e. it defaults to authentication requirements are standard, tested and approved authentication requirement, or it allowing access) too weak, or there is no authentication was assumed authentication requirement to re-authenticate module/framework/service, would be undertaken by some for these separate to the resource being other system, or was performed requested, is not being used in some previous action Q K Authentication Authentication Jaime can bypass authentication Olga can influence or alter (no card) (no card) because it is not enforced authentication code/routines so comprehensively across all entry they can be bypassed points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration)
Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because there is no authentication requirement, or it was assumed authentication would be undertaken by some other system, or was performed in some previous action Authentication Q Authentication K Jaime can bypass authentication because it is not enforced comprehensively across all entry points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card)
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx