E of Tampering II
Data in the database can be fixed by the admins, and nobody will ever know:
|
Threat |
|
|
|
Your administrators can modify their permissions to grant themselves read/write access to data without secondary approval. |
|
CAPEC |
N/A |
|
ASVS |
7.1.3: Ensure security events are being logged 7.1.4: Ensure log entries contain all the necessary information for an investigation 7.2.1: Ensure both authentication successes and failures are logged 7.2.2: Ensure both authorization successes and failures are logged |
|
CWE |
CWE-778: Insufficient Logging |
|
Mitigations |
|
|
|
|
