A09 — Security Logging & Alerting Failures
Security logs help organizations detect, investigate, and respond to suspicious activities.
Security Logging & Alerting Failures occur when important security events are not properly recorded, monitored, or alerted.
Examples include:
Failed login attempts not being logged
Privilege changes not being recorded
Important security events missing from logs
No alerts for suspicious activity
Logs that are difficult to monitor or investigate
For example:
Multiple Failed Logins
|
Logging
|
Alerting
|
Security Investigation
Prevention: Log important security events, protect logs from unauthorized modification, monitor them regularly, and configure appropriate alerts.
Key point: If an attack cannot be detected, it becomes much harder to respond to it.
A10 — Mishandling of Exceptional Conditions
Applications constantly encounter unexpected situations such as invalid input, database failures, network errors, and resource limitations.
Mishandling of Exceptional Conditions occurs when these situations are handled insecurely.
For example, an application may normally deny an operation, but an unexpected error could cause it to fail open and accidentally allow the operation.
Common examples include:
Improper error handling
Failing open
Insecure default behavior
Unhandled exceptions
Exposing sensitive information through errors
A secure application should maintain its security controls even when something goes wrong.
Prevention: Handle errors safely, use secure defaults, validate unexpected conditions, and test failure scenarios.
Key point: Security should not disappear when the application encounters an error
