Root Cause Analysis of Broken Access Control

Broken Access Control

• Application Design
  • Missing Access Checks
  • Assumes UI restricts access
  • Insecure Direct Object References (IDOR)
  • Object identifiers exposed in URLs
• Development Practices
  • Lack of Code Review
  • Access control flaws not identified
  • No Secure Coding Standards
  • Developers unaware of security risks
• Authentication & Authorization
  • Missing Authorization Checks
  • Endpoints do not enforce user roles
  • Role-based Access Misconfigurations
  • Excessive privileges granted
• Configuration
  • Default Accounts Enabled
  • Default credentials not changed
  • Improper Permissions on Resources
  • Public access to sensitive files
• Testing and QA
  • Functional Testing Only
  • Security not in test scope
  • Insufficient Security Testing
  • Lack of penetration testing
• Organizational Factors
  • Insufficient Training
  • Employees unaware of access control importance
  • Lack of Security Policies
  • No standard for access control

Suggested Actions Checklist

Here are some corrective actions, preventive actions and investigative actions that organizations may find useful:

• Application Design
  • Missing Access Checks
    • Corrective Actions:
    • Implement backend-level access control mechanisms independent of the UI.
    • Preventive Actions:
    • Incorporate mandatory backend access checks in design specifications and threat models.
    • Investigative Actions:
    • Review existing modules to identify where access checks are UI-dependent and conduct access control audits.
  • Insecure Direct Object References (IDOR)
    • Corrective Actions:
    • Implement indirect object references (e.g., tokenized or mapped IDs) and validate user access to each object.
    • Preventive Actions:
    • Mandate secure object reference handling in design standards and developer onboarding.
    • Investigative Actions:
    • Audit all endpoints for exposure of direct identifiers and map affected assets/users.
• Development Practices
  • Lack of Code Review
    • Corrective Actions:
    • Introduce mandatory peer code reviews focusing on access control logic.
    • Preventive Actions:
    • Establish and enforce a secure code review checklist as part of the software development lifecycle (SDLC).
    • Investigative Actions:
    • Conduct a retrospective analysis of past commits to find missed access flaws.
  • No Secure Coding Standards
    • Corrective Actions:
    • Develop and distribute secure coding guidelines tailored to the tech stack.
    • Preventive Actions:
    • Make secure coding practices part of the development onboarding and performance metrics.
    • Investigative Actions:
    • Analyze recent vulnerabilities for patterns suggesting ignorance of secure practices.
• Authentication & Authorization
  • Missing Authorization Checks
    • Corrective Actions:
    • Patch affected endpoints with proper role validation logic.
    • Preventive Actions:
    • Implement authorization middleware or access control libraries across services.
    • Investigative Actions:
    • Identify all endpoints lacking explicit authorization logic through code scanning or reviews.
  • Role-based Access Misconfigurations
    • Corrective Actions:
    • Audit and reconfigure roles and permissions to adhere to the principle of least privilege.
    • Preventive Actions:
    • Automate role assignment with pre-defined access levels and approval workflows.
    • Investigative Actions:
    • Evaluate user activity logs to detect over-privileged access patterns.
• Configuration
  • Default Accounts Enabled
    • Corrective Actions:
    • Disable or remove unused default accounts and change default credentials immediately.
    • Preventive Actions:
    • Include a configuration hardening checklist as part of deployment pipelines.
    • Investigative Actions:
    • Scan for active default accounts and assess their usage history.
  • Improper Permissions on Resources
    • Corrective Actions:
    • Reconfigure file and resource permissions to restrict public or unauthorized access.
    • Preventive Actions:
    • Integrate permission checks in the CI/CD pipeline for deployment readiness.
    • Investigative Actions:
    • Inventory all accessible resources and verify against expected access controls.
• Testing and QA
  • Functional Testing Only
    • Corrective Actions:
    • Expand test coverage to include access control and security scenarios.
    • Preventive Actions:
    • Integrate security testing into the definition of done (DoD) for QA processes.
    • Investigative Actions:
    • Review historical test cases and identify critical security gaps not covered.
  • Insufficient Security Testing
    • Corrective Actions:
    • Schedule and perform comprehensive penetration testing and vulnerability assessments.
    • Preventive Actions:
    • Adopt security testing tools and practices (e.g., DAST, SAST) as mandatory QA steps.
    • Investigative Actions:
    • Analyze previous releases for missed vulnerabilities and correlate with real-world incidents.
• Organizational Factors
  • Insufficient Training
    • Corrective Actions:
    • Conduct targeted training on secure access control principles for developers and QA.
    • Preventive Actions:
    • Implement mandatory, recurring security training sessions for all technical roles.
    • Investigative Actions:
    • Assess employee awareness via surveys or interviews post-incident.
  • Lack of Security Policies
    • Corrective Actions:
    • Draft and enforce a formal access control policy with ownership and review cadence.
    • Preventive Actions:
    • Include policy adherence checks in internal audits and governance reviews.
    • Investigative Actions:
    • Benchmark current practices against industry standards to identify gaps in policy coverage.