new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/logging

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Authorization logging importance

Logging is one of the most important detective controls in application security. Insufficient logging and monitoring is recognized as among the most critical security risks in OWASP's Top Ten 2021 (A09). Appropriate logs can detect malicious activity, serve as invaluable resources in post-incident investigations, troubleshoot access control and other security problems, and are useful in security auditing. Though easy to overlook during initial design and requirements, logging is an important component of holistic application security and must be incorporated into all SDLC phases.

Authorization logging implementation guidelines

Recommendations for logging include: (1) Log using consistent, well-defined formats that can be readily parsed for analysis. According to OWASP Top Ten Proactive Controls C9, Apache Logging Services is one example providing support for numerous languages and platforms. (2) Carefully determine the amount of information to log according to specific application environment and requirements. Both too much and too little logging may be security weaknesses (CWE-778 and CWE-779). Too little logging results in malicious activity going undetected and greatly reduces post-incident analysis effectiveness. Too much logging strains resources, leads to excessive false positives, and may result in sensitive data being unnecessarily logged. (3) Ensure clocks and timezones are synchronized across systems, as accuracy is crucial in piecing together attack sequences during and after incident response. (4) Consider incorporating application logs into a centralized log server or SIEM.

Give your agent this brain