Friday, January 27, 2017

Dev-Sec Guideline: Build to not trust endpoint input and services

Guideline: Build to not trust endpoint input and services

Part of: Development Security Guidelines
OverviewBuilding a set of Guidelines for Security and Privacy

Do not ever trust input coming from users, browsers, apps, services, and APIs and other (end)points from non-trusted sources. Always presume malicious entries that needs to be validated, and where applicable, sanitized.

This guideline is all about trust. Anything can be trusted, and in some cases such trust needs to be validated beforehand. Input from sources you do not control needs to be validated before trusted.

In essence, just like the positive security model, it is all about input validation. But where the positive security model focuses more on the security controls itself, this principle focuses on the data.

Due to compute power and memory processing it is wise to make informed decisions about whether or not to apply input validation wherever data is being processed. Only make sure that whenever data is coming from users, browsers, apps, services and APIs or any other non-controlled endpoint for that matter, that the data has been validated. And this validation can vary from making sure a date is really a date to that of free text input is being stripped from any scripting-languages.

More information from OWASP about a Don’t trust user input and Don't trust services.
More information from about Input Validation for Web-applications.


Post a Comment