access to a resource. • Composed by several elements often named Dimensions. • Dimensions often used are the Feature and the Logical role. • Sometimes a Data dimension is used to filter access at data level. • Will focus here on the Feature and the Logical role dimensions. Authorization will be named Authz in the rest of the presentation.
BASIC ADMIN ReadSingleMessage Grant Grant Grant ReadAllMessages Grant Grant Grant CreateMessage Deny Grant Grant DeleteMessage Deny Deny Grant One feature x One logical role = One Authz List of features x List of logical roles = Authz matrix
access to a resource with create, read or modify operations. • Real life impact, do you feel comfortable if: • Bank: I can access to your account? Your Credit card? • Healthcare: I can access to your medical profile? • Mobile: I can access to all your phone Call/SMS with content details? • Exchange: I can access to all your private and professional emails? • Authz issues can lead to data breaches!
Hard to define a stable Authz matrix (Features x Logical roles) on the application life time (new feature, teammates change…). • Vulnerability scanner, Web Application Firewall, Intrusion Detection System…Can’t help here because they can’t identify a lawful from an unlawful access Stream is legit! • Most Authz matrix are tested manually by functional test team, it’s hard to test all combinations (time-consuming & mental tiredness) before every release, moreover in Agile/CD project…
With time, Authz matrix loss the sync with the real Authz matrix implemented in the application, moreover in maintenance life phase. • Hard to quickly provide an up-to-date representation of the Authz matrix to an external/internal security auditor.
ensure that the Authz matrix is in sync with its implementation in the application Spot desync quickly! • Tests all combinations of the Authz matrix at every Authz matrix test round. • Be able to generate a representation of the Authz matrix according to the target recipient: Security auditor, CISO, security architect…
of the Authz matrix with the application code in the SCM: Authz matrix become an asset of the project code baseline. • Any update on Authz matrix can be back-traced through the SCM log history. • Gain time in Authz matrix test round and reduce risk of human error during manual testing.
an example of approach for an application exposing a REST API but the concepts/codes shown can be used for others application types. • The sample REST API use JSON Web Token to hold authentication. • Why have I choose a REST API application types for the proposed approach? • The application which I meet, expose very often a REST (like) API . • It’s the most popular application topology meet today in the context of Single Page Application or Micro Services based system.
matrix in a pivot file that will allow us to derivate it in different others representations (HTML, Excel…). • Tests cases will use this pivot file to determine each test context and expected behaviour. • Test code will be reusable for other projects/technologies. • Test code will be simple and use standard API/framework in order to: • Be integrated in popular IDE and Continuous Integration Platform. • Generate test reports in a format already used by dev team.
righettod
irumaru
fabpot
osakatechlab
kentaroutakeda
yuichiro_serita
chiroruxx
ivargrimstad
philipschwarz
tera_ny
memory1994
manfredsteyer
utgwkk
gr2m
shpigford
afnizarnur
tammyeverts
maltzj
ammeep
jponch
morganepeng
eileencodes
chrisshort
garrettdimon
addyosmani
