Difference between revisions of "Don’t trust services"

From OWASP
Jump to: navigation, search
Line 3: Line 3:
 
{{Template:Stub}}
 
{{Template:Stub}}
  
==Categories==
+
==Overview==
 +
 
 +
Services can mean any external system.
 +
 
 +
Many organizations utilize the processing capabilities of third party partners, who more than likely have differing security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners.
 +
 
 +
Therefore, implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion.
 +
 
 +
For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end users, and that the reward points are a positive number, and not improbably large.
  
 
[[Category:Principle]]
 
[[Category:Principle]]

Revision as of 09:52, 14 June 2006

This is a principle or a set of principles. To view all principles, please see the Principle Category page.

This article is a stub. You can help OWASP by expanding it or discussing it on its Talk page.


Overview

Services can mean any external system.

Many organizations utilize the processing capabilities of third party partners, who more than likely have differing security policies and posture than you. It is unlikely that you can influence or control any external third party, whether they are home users or major suppliers or partners.

Therefore, implicit trust of externally run systems is not warranted. All external systems should be treated in a similar fashion.

For example, a loyalty program provider provides data that is used by Internet Banking, providing the number of reward points and a small list of potential redemption items. However, the data should be checked to ensure that it is safe to display to end users, and that the reward points are a positive number, and not improbably large.