The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

230

Chapter 8 

■

Attacking Access Controls

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 230

---

■■

It improves adaptability. Where new access control requirements arise,

these can be easily reflected within an existing API implemented by

each application page.

■■

It results in fewer mistakes and omissions than if access control code is

implemented piecemeal throughout the application.

A Multi-Layered Privilege Model

Issues relating to access apply not only to the web application itself but also to

the other infrastructure tiers which lie beneath it — in particular, the applica-

tion server, the database, and the operating system. Taking a defense-in-depth

approach to security entails implementing access controls at each of these lay-

ers to create several layers of protection. This provides greater assurance

against threats of unauthorized access, because if an attacker succeeds in com-

promising defenses at one layer, the attack may yet be blocked by defenses at

another layer.

In addition to implementing effective access controls within the web appli-

cation itself, as already described, a multi-layered approach can be applied in

various ways to the components which underlie the application, for example:

■■

The application server can be used to control access to entire URL

paths, on the basis of user roles that are defined at the application

server tier.

■■

The application can employ a different database account when carrying

out the actions of different users. For users who should only be query-

ing (and not updating) data, an account with read-only privileges

should be used.

■■

Fine-grained control over access to different database tables can be

implemented within the database itself, using a table of privileges.

■■

The operating system accounts used to run each component in the

infrastructure can be restricted to the least powerful privileges that the

component actually requires. 

In a complex security-critical application, layered defenses of this kind can

be devised with the help of a matrix defining the different user roles within the

application and the different privileges, at each tier, that should be assigned to

each role. Figure 8-1 is a partial example of a privilege matrix for a complex

application.