Description
The software has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-657
CWE-693
Consequences
Access Control: Bypass Protection Mechanism
By bypassing the security mechanism, a user might leave the system in a less secure state than intended by the administrator, making it more susceptible to compromise.
Potential Mitigations
Phase: Testing
Description:
Where possible, perform human factors and usability studies to identify where your product’s security mechanisms are difficult to use, and why.
Phase: Architecture and Design
Description:
Make the security mechanism as seamless as possible, while also providing the user with sufficient details when a security decision produces unexpected results.
CVE References
