[ISM] Security verification:

[OWASP] Secure business logic workflows (SSS-02-11-11)

Secure business logic workflows to prevent logical flaws that attackers can exploit. For example, validate critical transactions, enforce rate limits on automated processes, and prevent workflow abuse that could lead to financial or reputational loss; Apply authorization checks within business logic to prevent privilege escalation and unauthorized actions; Continuously audit, test, and monitor business processes to detect and mitigate logic-based security risks.

[OWASP] Secure business logic (SSS-02-11-11-01)

V11.1 Business Logic Security Requirements -Design secure business logic by ensuring it is resilient to manipulation and cannot be bypassed by attackers. This includes considering potential edge cases and abnormal user behavior. -Implement strong access control to ensure only authorized users can access or modify business-critical functions and data. -Protect sensitive business workflows (e.g., financial transactions, sensitive data processing) with additional layers of security, such as multi-factor authentication (MFA), validation of input, and role-based access control (RBAC). -Verify that business rules are enforced consistently across all components of the application, including APIs, user interfaces, and background processes. -Monitor for abnormal activities that could indicate business logic abuse, such as unexpected patterns of behavior or excessive usage of particular functions. -Test business logic thoroughly, including use cases and misuse cases, to identify potential vulnerabilities or unintended behaviors. -Minimize complex workflows to reduce the attack surface and ensure easier auditing and detection of malicious activities. By designing secure, consistent, and validated business logic, organizations can protect against attacks that exploit weaknesses in core business processes.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-11-11-01-01	Ensure business logic is not exploitable	Prevent exploitation of business logic by identifying and mitigating potential abuse scenarios, such as misuse of discount codes, invalid workflows, or unintended system behavior.	Development	Security Engineers, Business Analysts
SSS-02-11-11-01-02	Enforce business logic workflows	Implement strict enforcement of business workflows to prevent logic-based attacks, ensuring that business processes follow the intended rules and restrictions.	Development	Software Architects, Security Teams
SSS-02-11-11-01-03	Prevent automation attacks	Implement measures to protect against automation attacks (e.g., bot-driven abuse of business rules) by using CAPTCHA, rate limiting, and bot detection systems.	Development	Security Engineers, IT Operations
SSS-02-11-11-01-04	Add extra authentication for security-critical transactions	Ensure that sensitive or security-critical transactions, such as fund transfers or changes to user accounts, require additional authentication layers (e.g., multi-factor authentication).	Deployment	Security Teams, IT Operations
SSS-02-11-11-01-05	Protect against replay attacks	Implement mechanisms to prevent replay attacks on business logic workflows, such as using unique tokens for each transaction and enforcing timestamps or nonce validation.	Post-deployment	Security Teams, DevOps Teams

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-0971) OWASP Application Security Verification Standard OWASP Application Security Verification Standard