093 – Use consistent certificates
Summary
The system must use digital certificates with a consistent identification of the associated organization (service, server, etc.).
Description
This requirement indicates the importance of maintaining consistency in the identification information embedded within digital certificates used by the system. Digital certificates play an important role in authenticating and securing communication, and having consistent identification ensures trustworthiness, and effective management. Consistent identification refers to maintaining uniform and accurate information within the digital certificates associated with the organization, service, server, or any entity using the certificates.
Supported In
Advanced: True
References
- CAPEC-475. Signature spoofing by improper validation
- CWE-295. Improper certificate validation
- CWE-297. Improper validation of certificate with host mismatch
- OWASP10-A7. Identification and authentication failures
- IEC62443-IAC-1_8. Public key infrastructure (PKI) certificates
- PTES-6_7. Exploitation - Zero day angle
- PTES-7_4_2_7. Post exploitation - Pillaging (certificate authority)
- PTES-7_7. Post Exploitation - Persistence
- BSAFSS-EN_3-2. Software protects and validates encryption keys
- BSAFSS-EN_3-3. Software protects and validates encryption keys
- ASVS-10_3_1. Application integrity
- SIG-I_3_2_4_2. Application security
- RESOLSB-Art_30_1. Security in Electronic Channels - Digital Banking
- OWASPMASVS-NETWORK-2. The app performs identity pinning for all remote endpoints under the developer's control
Weaknesses
Last updated
2024/01/18