7.2.4 (v4.0.3-9.2.5) - improve the wording to cover all connection errors and failed certificate checks

[elarlang]

Current requirement was moved from 9.2.5 to 7.2.4 (#1890)

#	Description	L1	L2	L3	CWE
7.2.4	[MOVED FROM 9.2.5] Verify that backend TLS connection failures are logged.			✓	778

Proposal: make the requirement to cover all connection errors.

.. or, have 2 requirements:

• all connection errors (database connection, external API connection, etc)
• all failed certificate checks

[tghosth]

I still don't like this. I think it is too specific and for logging we need to focus on principles rather than specific events. I would happily just drop this requirement.

I also think we need to better differentiate between regular logging (which might be a short term thing) and security audit logs which may need to be longer term (e.g. account details change history).

[elarlang]

My proposal was to make it more abstract.

Anyway, waiting outcome from #1795 (comment)

[jmanico]

Elar. As mentioned in #1795 (comment) I think it's fair to see security logging as a lower priority in the interest of getting 5.0 live.

Perhaps a more general requirement "do security logging on ASVS requirements that fail" or similar is the right way to go for 5.0.

[tghosth]

This should be removed once #1944 is merged. The original requirement should be tagged as merged into 7.2.3.

Additional events added to the logging cheatsheet here: OWASP/CheatSheetSeries#1394

[tghosth]

@set-reminder in 1 week @tghosth to address once #1944 is merged

[octo-reminder]

⏰ Reminder
Thursday, May 9, 2024 12:00 AM (GMT+02:00)

in @tghosth to address once #1944 is merged

[tghosth]

@elarlang actually I see this as slightly different case to 7.2.3.

7.2.3 is deliberate bypass attempts. 7.2.6 is general security control failures, might not be malicious. I would therefore keep them separate.

Opened #1947

What do you think?

[elarlang]

I can understand the difference, but I'm concerned, is it also understandable when just reading the requirements.

#	Description	L1	L2	L3	CWE
7.2.3	[MODIFIED, MOVED FROM 7.1.3] Verify that the application logs attempts to bypass the security controls defined in the design documentation such as input validation.		✓	✓	778
7.2.6	[MOVED FROM 9.2.5] Verify that the application logs security control failures such as backend TLS failures.			✓	778

I don't have any recommendations, accepting PR.

[tghosth]

Let's leave it for now and see if anyone complains during the draft :)

[octo-reminder]

🔔 @tghosth

in @tghosth to address once #1944 is merged