Insecure Design
Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.
概要
Slides from #4 to #6 in 2025. Introduced in 2021, there have been noticeable improvements in the industry related to threat modeling and greater emphasis on secure design. Focus on risks related to design and architectural flaws.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Business logic bypass
Application flows can be circumvented because the design didn't account for all possible user paths or state transitions.
Missing rate limiting
Sensitive operations like password reset or account creation lack rate limits, enabling automated attacks.
Insufficient anti-automation
Critical functions lack protections against automated abuse, such as CAPTCHA or proof-of-work.
予防方法
- Establish a secure development lifecycle with security professionals
- Use threat modeling for critical authentication and access control
- Integrate security language and controls into user stories
- Write unit and integration tests to validate security controls
- Segregate tier layers based on exposure and protection needs
- Limit resource consumption by user or service
Shoulder検出付きCWE (8)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
その他のマップされたCWE (32)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。