[ISM] Proactive Controls (OWASP Top):

[OWASP] Implement strong identity management (SSS-02-12-07)

Ensure robust digital identity management by implementing secure authentication, session management, and identity verification mechanisms. For example, enforce strong authentication methods such as multi-factor authentication (MFA) to verify users reliably; Secure session management by preventing session fixation, enforcing timeouts, and protecting session tokens from theft; Assign experienced security engineers to oversee identity-related components due to their complexity and high security impact; Follow industry standards like NIST 800-63B to ensure best practices in authentication and identity lifecycle management; Continuously monitor and audit authentication and session controls to prevent identity-based attacks and unauthorized access.

[OWASP] Strengthen authentication and session security (SSS-02-12-07-01)

1. Password Security -Enforce NIST 800-63b password guidelines and block weak passwords. -Use temporary, one-time links for password resets; avoid security questions. -Hash passwords using Argon2, bcrypt, or PBKDF2—never store in plaintext. 2. Server-Side Session Management -Generate high-entropy session IDs and expire sessions after logout, inactivity, or timeout. -Store sessions server-side, not on the client. 3. Client-Side Session Management (JWTs) -Use short-lived JWTs and store them in HTTPOnly cookies, not local storage. Implement token revocation for long-lived JWTs. 4. Secure Cookies -Set HttpOnly, Secure, and SameSite attributes to protect against XSS and CSRF. -Expire session cookies on logout and enforce HTTPS. By enforcing strong passwords, secure session handling, and protecting cookies, organizations can mitigate brute force, session hijacking, and credential theft.

Operations

ID	Operation	Description	Phase	Agent
SSS-02-12-07-01-01	Implement secure password requirements	Enforce strong password policies (e.g., minimum length, complexity) to ensure that passwords are difficult to guess or brute-force. Require users to choose secure passwords during account creation.	Development	Security Engineers, Software Developers
SSS-02-12-07-01-02	Implement secure password recovery mechanism	Provide a secure method for users to recover or reset their passwords, such as multi-factor authentication (MFA) during the recovery process, to prevent unauthorized password changes.	Development	Security Teams, Product Managers
SSS-02-12-07-01-03	Ensure secure password storage	Store passwords securely by using modern hashing algorithms like bcrypt, Argon2, or PBKDF2 with salting, and ensure that passwords are never stored in plaintext.	Development	Security Engineers, DevOps Teams
SSS-02-12-07-01-04	Implement server-side session management	Ensure secure session generation, expiration, and invalidation on the server side. Implement measures such as session timeouts and token revocation to manage session integrity and prevent unauthorized access.	Deployment	Security Engineers, DevOps Teams
SSS-02-12-07-01-05	Use client-side session management with jwt	Use secure client-side session management, such as JWT (JSON Web Tokens), for maintaining authenticated user sessions. Ensure that tokens are encrypted, have an expiration date, and are securely stored in browser cookies.	Development	Security Engineers, Web Developers

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1849) OWASP Proactive Controls OWASP Proactive Controls