Data Integrity Failures
Data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization and unsigned updates.
概要
Renamed from 'Software and Data Integrity Failures' to 'Data Integrity Failures'. Focus on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
Insecure deserialization
Untrusted data is deserialized by the application, potentially leading to remote code execution.
Unsigned updates
Software updates are accepted without verifying their authenticity, allowing malicious updates.
Data tampering
Critical data lacks integrity verification, allowing modification without detection.
予防方法
- Use digital signatures to verify software or data is from expected source
- Ensure libraries and dependencies are from trusted repositories
- Use software supply chain security tools to verify components
- Ensure CI/CD pipeline has proper segregation and access control
- Ensure unsigned or unencrypted serialized data is not sent to untrusted clients
- Implement integrity checks for critical data
Shoulder検出付きCWE (2)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
その他のマップされたCWE (8)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。