Add Identity and Access Management dimension - #82
Conversation
|
This one's been a bit of a tough one, since you have to frame the dev team's responsibilities from an IT ops standpoint. Feedback would be appreciated. I could see this growing bigger in the future, but I think it's a good starting point, given broken access control is still #1 in the OWASP Top 10. |
|
Do we need to cleanup, e.g. moving https://dsomm.owasp.org/activity-description?uuid=598e9f13-1ac8-4a01-b85e-8fab93ee81de to this subdimension? Can we delete or move https://dsomm.owasp.org/activity-description?uuid=070bb14b-e04a-4f3d-896a-a08eba7a35f9 ? |
|
i would move RBAC and MFA https://dsomm.owasp.org/#598e9f13-1ac8-4a01-b85e-8fab93ee81de, but leave MFA for admins where it is thoughts? |
|
Why would that not be in the new dimension? They are both very much connected I will one day change RBAC to Attribute Based Access Control. |
|
Yes, you're absolutely correct. I got confused, as I was thinking it was specifically related to infrastructure. There is also a simple access controls category for systems: https://dsomm.owasp.org/#82e499d1-f463-4a4b-be90-68812a874af6. I'll move that as well. I think RBAC might be better positioned as "Fine-Grained Access Controls", encompassing approaches such as ABAC, RBAC, and PBAC. That would align better with the Simple Access Controls category as well. |
|
Drafted the change for RBAC |
2 participants
Adds a new "Identity and Access Management" dimension to the Implementation stage, covering both governance controls (central SSO/IdP for human access, account inventory, segregation of duties, automated joiner-mover-leaver provisioning, periodic access recertification, just-in-time privileged access) and controls owned directly by developers (server-side authorization enforcement, automated authorization test coverage, correct OAuth2/OIDC flows, least-privilege scoping for service accounts and CI permissions).
Non-human identities (service accounts, workload identities, CI/CD pipelines) are called out explicitly since they're an increasingly common source of access-related incidents.