new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/least_privileges

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Least Privileges principle - application to development

Least Privileges refers to assigning users only the minimum privileges necessary to complete their job. Although commonly applied in system administration, this principle is relevant to software developers. Least Privileges must be applied both horizontally and vertically. For example, an accountant and sales representative at the same organizational level require access to different resources; the accountant should not access customer databases and the sales representative should not access payroll data. The head of a department typically needs more privileged access than subordinates. Failure to enforce least privileges can jeopardize confidentiality of sensitive resources.

Least Privileges implementation during design phase

During the design phase, ensure trust boundaries are defined. Enumerate user types accessing the system, exposed resources, and operations (read, write, update, etc.) that might be performed on those resources. For every combination of user type and resource, determine what operations the user (based on role and/or other attributes) must be able to perform on that resource. For ABAC systems, ensure all categories of attributes are considered. For example, a Sales Representative may need to access a customer database from the internal network during working hours but not from home at midnight.

Least Privileges testing and verification

Create tests that validate permissions mapped out in the design phase are being correctly enforced. After app deployment, periodically review permissions for 'privilege creep' to ensure user privileges do not exceed those defined during design (plus or minus formally approved changes). Remember that it is easier to grant users additional permissions rather than revoke previously enjoyed ones. Careful planning and implementation of Least Privileges early in the SDLC reduces the risk of needing to revoke overly broad permissions.

Give your agent this brain