Proposal: merge 13.2.4 to 11.1.4

[elarlang]

Current 13.2.4:

Verify that REST services have anti-automation controls to protect against excessive calls, especially if the API is unauthenticated.

• Level: 2, 3
• CWE: 770

Current 11.1.4:

Verify the application has sufficient anti-automation controls to detect and protect against data exfiltration, excessive business logic requests, excessive file uploads or denial of service attacks.

• Level: 1, 2, 3
• CWE: 770

Those seems like duplicates. Would like to know more, why there is separate requirement (13.2.4) for API, with different level.

If there is no good reason, I prefer to merge them to 11.1.4. Personally I don't see the need for special requirement for an API, as it does not contain anything specific.

[jmanico]

I think merging them into 11.1.4 is a good idea. A merge would look like:

Verify that application has anti-automation controls to protect against excessive calls such as mass data exfiltration, excessive business logic requests, excessive file uploads or denial of service attacks, especially if the API is unauthenticated.

The point being, this is almost impossible to accomplish for un-authenticated users.

[danielcuthbert]

it is also timely given a fair number of services (linkedin, clubhouse etc) who have been impacted by this attack. Agree with you both here, no need for it to be API specific

[elarlang]

This repeated "excessive" does not feel good, and "especially this one case" also.

Verify that application has anti-automation controls to protect against excessive calls such as mass data exfiltration, excessive business logic requests, excessive file uploads or denial of service attacks especially if the API is unauthenticated.

Proposal:

Verify that application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks.

[jmanico]

Looks like a solid improvement +1

…

On 4/20/21 9:46 AM, Elar Lang wrote: This repeated "excessive" does not feel good, and "especially this one case" also. Verify that application has anti-automation controls to protect against excessive calls such as mass data exfiltration, excessive business logic requests, excessive file uploads or denial of service attacks especially if the API is unauthenticated. Proposal: Verify that application has anti-automation controls to protect against excessive calls such as mass data exfiltration, business logic requests, file uploads or denial of service attacks. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#971 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEBYCNT6ALJU6PCSHPJLFLTJWATVANCNFSM426BP2VQ>.