Working from home may reveal the flaws of applications and processes in use, so double-checking access controls and privilege escalation possibilities is highly recommended.
Web applications are more popular than ever, and people prefer working remotely from home instead of sitting in the office. In-house applications are no longer used only in the office; employees use them from several locations. Have these apps really been prepared for remote work from a security point of view?
Employees using the application tend to spend more time digging into the system and looking for shortcuts to solve their issues, simply because managers and administrators are not as easy to reach as they would be in the office. Some users may already know a few tricks for reaching functions they are not authorised to use.
It is a cliché, but users are the biggest risk to any system.
A well-designed and well-implemented authorisation system can protect you from unauthorised access. But is that really true?
A common problem with bespoke software is that the different user levels are not separated well enough. By modifying URLs, or simply by guessing, users may access data that should not be available to them. In IT security terminology this is called “privilege escalation”, and it is often the source of the most serious problems in a multi-layered software architecture.
Unauthorised access can almost never be detected by internal testers or automated tools. A thorough log analysis can help after a potential data breach, but it cannot prevent one.
Regular and thorough security testing can identify these flaws. At Whiteshield, we pay particular attention to potential privilege escalation issues during web application testing, using manual techniques.