2 cissp ® Official Study Guide Eighth Edition

Time of Check to Time of Use
The 
time of check to time of use (TOCTOU or TOC/TOU)
issue is a timing vulnerability 
that occurs when a program checks access permissions too far in advance of a resource 
request. For example, if an operating system builds a comprehensive list of access permis-
sions for a user upon logon and then consults that list throughout the logon session, a 
TOCTOU vulnerability exists. If the system administrator revokes a particular permission, 
that restriction would not be applied to the user until the next time they log on. If the user 
is logged on when the access revocation takes place, they will have access to the resource 
indefinitely. The user simply needs to leave the session open for days, and the new restric-
tions will never be applied.
Back Doors
Back doors
are undocumented command sequences that allow individuals with knowl-
edge of the back door to bypass normal access restrictions. They are often used during the 
development and debugging process to speed up the workflow and avoid forcing develop-
ers to continuously authenticate to the system. Occasionally, developers leave these back 
doors in the system after it reaches a production state, either by accident or so they can 
“take a peek” at their system when it is processing sensitive data to which they should not 
have access. In addition to back doors planted by developers, many types of malicious code 

---

Web Application Security 
935
create back doors on infected systems that allow the developers of the malicious code to 
remotely access infected systems.
No matter how they arise on a system, the undocumented nature of back doors makes 
them a significant threat to the security of any system that contains them. Individuals with 
knowledge of the back door may use it to access the system and retrieve confidential infor-
mation, monitor user activity, or engage in other nefarious acts.