new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authorization/static_resources

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Static resource authorization requirements

The importance of securing static resources is often overlooked. Although securing databases and data stores justly receive significant attention, static resources must also be appropriately secured. Although unprotected static resources are a problem for websites and web applications, poorly secured resources in cloud storage offerings such as Amazon S3 Buckets have risen to prominence in recent years.

Static resource security implementation

When securing static resources: (1) Ensure static resources are incorporated into access control policies. The type of protection required will necessarily be highly contextual; some static resources may be perfectly acceptable when publicly accessible, while others should only be accessible when highly restrictive user and environmental attributes are present. Consider establishing a formal Data Classification scheme and incorporating it into the application's access control logic. (2) Ensure any cloud-based services used to store static resources are secured using the configuration options and tools provided by the vendor. Review cloud provider documentation such as AWS, Google Cloud, and Azure guidance for specific implementation details. (3) When possible, protect static resources using the same access control logic and mechanisms used to secure other application resources and functionality.

Give your agent this brain