search

nmfta-repo / nmfta-opentelematics-api

API Blueprint for Open Telematics API
Apache License 2.0
13 stars 6 forks source link

design testing for security #149

Closed BenGardiner closed 5 years ago

BenGardiner commented 5 years ago

Add a design testing report to the document which replaces VERIFIED with CONFIRMED <+ rationale> to demonstrate that the API design has some security properties baked-in. Thanks, Altaz.

NIST 800-53 SC-6: Resource Availability Considerations:

  1. URL size should not exceed 2000 characters - VERIFIED?
  2. HTTP request size should not exceed 1MB limit - VERIFIED?

NIST 800-53 SI-10: Information Input Validation Considerations: All file references should be indirect

  1. There are no direct file references - VERIFIED?

NIST 800-53 AC-3: Access Enforcement Considerations: Grant privileges directly to users

  1. Driver login endpoint - VERIFIED?
  2. Token required before request - VERIFIED?

NIST 800-53 AC-24: Access Control Decisions Considerations: Security controls assigned to each request

  1. Token required for each request - VERIFIED?

NIST 800-53 AU-6: Audit Review, Analysis, and Reporting Considerations: Grant privileges to specific users

  1. Restricted endpoint for viewing logs - VERIFIED?
  2. Defined roles with access to logs - VERIFIED?