Randolph can access or predict Dan can influence or alter (no card) (no card) the master cryptographic secrets cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them A 2 3 Cornucopia Cornucopia Cornucopia Cornucopia You have invented a new attack (no card) Lee can bypass application Andrew can access source code, of any type controls because dangerous/risky or decompile, or otherwise access programming language functions business logic to understand how have been used instead of safer the application works and any alternatives, or there are type secrets contained conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model 4 5 6 7
Randolph can access or predict the master cryptographic secrets Dan can influence or alter cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them (no card) (no card) Cornucopia A Cornucopia Cornucopia 2 Cornucopia 3 You have invented a new attack of any type (no card) Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Andrew can access source code, or decompile, or otherwise access business logic to understand how the application works and any secrets contained Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model 4 5 6 7
20130225130129%21OWASP-Cornucopia-Ecommerce_Website.docx