Summary

The system must use digital certificates with a consistent identification of the associated organization (service, server, etc.).

Description

This requirement indicates the importance of maintaining consistency in the identification information embedded within digital certificates used by the system. Digital certificates play an important role in authenticating and securing communication, and having consistent identification ensures trustworthiness, and effective management. Consistent identification refers to maintaining uniform and accurate information within the digital certificates associated with the organization, service, server, or any entity using the certificates.

References

• CAPEC-475. Signature spoofing by improper validation
• CWE-295. Improper certificate validation
• CWE-297. Improper validation of certificate with host mismatch
• OWASP10-A7. Identification and authentication failures
• IEC62443-IAC-1_8. Public key infrastructure (PKI) certificates
• PTES-6_7. Exploitation - Zero day angle
• PTES-7_4_2_7. Post exploitation - Pillaging (certificate authority)
• PTES-7_7. Post Exploitation - Persistence
• BSAFSS-EN_3-2. Software protects and validates encryption keys
• BSAFSS-EN_3-3. Software protects and validates encryption keys
• ASVS-10_3_1. Application integrity
• SIG-I_3_2_4_2. Application security
• RESOLSB-Art_30_1. Security in Electronic Channels - Digital Banking
• OWASPMASVS-NETWORK-2. The app performs identity pinning for all remote endpoints under the developer's control

Weaknesses

• 163. Insecure digital certificates
• 167. Insecure service configuration - Wireless Certificates
• 348. Insecure digital certificates - Lifespan
• 350. Insecure digital certificates - Chain of trust