docs: update from A04, A05

Author: kenjis

user_guide_src/source/concepts/security.rst

@@ -229,36 +229,98 @@ CodeIgniter provisions
 A04:2021 Insecure Design
 ************************
 
-@TODO
+Insecure design is a broad category representing different weaknesses, expressed
+as “missing or ineffective control design.” Insecure design is not the source for
+all other Top 10 risk categories. There is a difference between insecure design
+and insecure implementation. We differentiate between design flaws and implementation
+defects for a reason, they have different root causes and remediation.
+
+A secure design can still have implementation defects leading to vulnerabilities
+that may be exploited. An insecure design cannot be fixed by a perfect implementation
+as by definition, needed security controls were never created to defend against
+specific attacks. One of the factors that contribute to insecure design is the
+lack of business risk profiling inherent in the software or system being developed,
+and thus the failure to determine what level of security design is required.
 
 OWASP recommendations
 =====================
 
-- @TODO
+- Establish and use a secure development lifecycle with AppSec professionals to
+  help evaluate and design security and privacy-related controls
+- Establish and use a library of secure design patterns or paved road ready to
+  use components
+- Use threat modeling for critical authentication, access control, business logic,
+  and key flows
+- Integrate security language and controls into user stories
+- Integrate plausibility checks at each tier of your application (from frontend
+  to backend)
+- Write unit and integration tests to validate that all critical flows are resistant
+  to the threat model. Compile use-cases and misuse-cases for each tier of your
+  application.
+- Segregate tier layers on the system and network layers depending on the exposure
+  and protection needs
+- Segregate tenants robustly by design throughout all tiers
+- Limit resource consumption by user or service
 
 CodeIgniter provisions
 ======================
 
-- @TODO
+- :doc:`PHPUnit testing <../testing/overview>`
+- :doc:`../libraries/throttler` for rate limit
+- An official authentication and authorization framework :ref:`CodeIgniter Shield <shield>`
 
 **********************************
 A05:2021 Security Misconfiguration
 **********************************
 
-Improper configuration of an application architecture can lead to mistakes
-that might compromise the security of the whole architecture.
+The application might be vulnerable if the application is:
+
+- Missing appropriate security hardening across any part of the application stack
+  or improperly configured permissions on cloud services.
+- Unnecessary features are enabled or installed (e.g., unnecessary ports, services,
+  pages, accounts, or privileges).
+- Default accounts and their passwords are still enabled and unchanged.
+- Error handling reveals stack traces or other overly informative error messages
+  to users.
+- For upgraded systems, the latest security features are disabled or not configured
+  securely.
+- The security settings in the application servers, application frameworks (e.g.,
+  Struts, Spring, ASP.NET), libraries, databases, etc., are not set to secure values.
+- The server does not send security headers or directives, or they are not set to
+  secure values.
+- The software is out of date or vulnerable (see A06:2021-Vulnerable and Outdated
+  Components).
+
+Without a concerted, repeatable application security configuration process,
+systems are at a higher risk.
 
 OWASP recommendations
 =====================
 
-- Presentation: harden web and application servers; use HTTP strict transport security
-- Controller: harden web and application servers; protect your XML stack
-- Model: harden database servers
+Secure installation processes should be implemented, including:
+
+- A repeatable hardening process makes it fast and easy to deploy another environment
+  that is appropriately locked down. Development, QA, and production environments
+  should all be configured identically, with different credentials used in each
+  environment. This process should be automated to minimize the effort required
+  to set up a new secure environment.
+- A minimal platform without any unnecessary features, components, documentation,
+  and samples. Remove or do not install unused features and frameworks.
+- A task to review and update the configurations appropriate to all security notes,
+  updates, and patches as part of the patch management process (see A06:2021-Vulnerable
+  and Outdated Components). Review cloud storage permissions (e.g., S3 bucket permissions).
+- A segmented application architecture provides effective and secure separation
+  between components or tenants, with segmentation, containerization, or cloud
+  security groups (ACLs).
+- Sending security directives to clients, e.g., Security Headers.
+- An automated process to verify the effectiveness of the configurations and
+  settings in all environments.
 
 CodeIgniter provisions
 ======================
 
-- Sanity checks during bootstrap
+- :ref:`Production mode <environment-constant>` by default
+- :ref:`secureheaders` filter
 
 *******************************************
 A06:2021 Vulnerable and Outdated Components