Examine the boundaries that protect application functionality, users and data. This pillar connects security principles to the way features are designed, implemented and changed.
All writing
Systems & Security
Application Security
How systems are protected.
Pillar 03
Definition
Technical areas
- Authentication, authorisation and session management
- Input validation, API security and common vulnerabilities
- Secrets management and secure development
What an assessment could examine
These are examples to adapt to the system and its risks, rather than results from an assessment.
- Compare expected permissions with server-side access checks, including attempts to access another test user’s resources.
- Review input handling and API behaviour for injection, unsafe output, unintended data exposure and missing validation.
- Trace how secrets are stored, accessed and rotated, and how security requirements are reviewed during development.
Possible improvements
Findings might lead to changes such as these. Prioritise the changes supported by evidence and verify their effect.
- Strengthen authentication and enforce resource ownership and permissions consistently.
- Correct unsafe input handling and add focused regression checks for confirmed vulnerabilities.
- Remove exposed secrets, rotate affected credentials and improve development review practices; retest the affected behaviour.