A07 — Authentication Failures
Authentication is the process of verifying a user's identity.
Authentication failures occur when an application does not properly protect the process of verifying users or managing their sessions.
Common examples include:
Weak authentication mechanisms
Weak password policies
Poor session management
Missing protection against automated attacks
Insecure password recovery
Improper handling of authentication tokens
For example, an application that allows unlimited login attempts without appropriate protections may be vulnerable to automated credential attacks.
Prevention: Use strong authentication mechanisms, secure session management, multi-factor authentication where appropriate, and protections against automated attacks.
Key point: Authentication should securely verify identity and protect the user's session throughout the application.
A08 — Software or Data Integrity Failures
Software or Data Integrity Failures occur when an application trusts software, updates, code, or data without properly verifying its integrity or authenticity.
Examples include:
Untrusted software updates
Compromised dependencies
Insecure CI/CD processes
Improperly validated serialized data
Using software or plugins from untrusted sources
For example:
Software Update
↓
Integrity Verification
↓
Trusted → Install
Untrusted → Reject
If an application installs or processes modified software or data without proper verification, an attacker may be able to introduce malicious content.
Prevention: Verify software and data integrity, secure CI/CD pipelines, use trusted dependencies, and implement proper signing and verification mechanisms.
Key point: Never blindly trust software or data received from an external source.
Top comments (0)