Test User Registration Process (OTG-IDENT-002)
Some websites offer a user registration process that provisions a person with access. The identity requirements for access vary from positive identification to none at all.
Verify the identity requirements for user registration align with business/security requirements
Validate the registration process
How to test
- Verify the identity requirements for user registration align with business/security requirements
- Can anyone register for access?
- Are registrations vetted by a human prior to provisioning, or are they automatically granted if the criteria are met?
- Can the same person/identity register multiple times?
- What proof of identity is required for a registration to be successful?
- Are registered identities verified?
- Validate the registration process
In contrast, the Google example below, the identification requirements include name, DOB, country, mobile phone number, email address and CAPTCHA response. While only two of these can be verified (email address and mobile number), the identification requirements are stricter than Wordpress.
Implement identification and verification requirements that correspond to the security requirements of the information the credentials protect.