Web Application Security Fundamentals #02: Tujuan Utama Web Security - CIA, Authenticity, dan Non-Repudiation

Security objectives mengarahkan setiap design decision, requirement, dan implementation. Pahami tujuan fundamental, dan Anda tahu apa yang perlu diproteksi.

The CIA Triad + 2

C - Confidentiality

Definition: Hanya authorized parties yang dapat akses data.

Example: Customer credit card number
- Confidential? YES
- Protection: Encryption (TLS in transit, AES at rest)
- Risk if breached: Financial fraud, identity theft

How to Test:

# Test 1: Can unauthorized user access data?
curl -H "Authorization: Bearer USER_B_TOKEN" \
  https://api.example.com/users/USER_A/profile
# Should return 403 Forbidden (not 200 OK with data)

# Test 2: Is data encrypted in transit?
# ✅ Good: HTTPS connection (encrypted)
# ❌ Bad: HTTP connection (plaintext)

# Test 3: Is sensitive data logged?
grep -r "password\|token\|credit_card" logs/
# Should return nothing

I - Integrity

Definition: Data hanya dapat dimodify oleh authorized parties, dan modifications dapat dideteksi.

Example: Bank transfer amount
- If attacker ubah $100 → $1000, integrity violated
- Protection: Digital signatures, checksums, audit logs

How to Test:

# Test 1: Can attacker modify request?
curl -X POST https://api.example.com/transfer \
  -d '{"to": "attacker", "amount": 1000000}'
# Server should validate amount matches DB price (not client input)

# Test 2: Is there audit log of changes?
SELECT * FROM audit_log WHERE action='transfer';
# Should show: WHO changed WHAT WHEN

# Test 3: Can changes be detected?
# Attacker modify database directly
UPDATE account SET balance = 999999 WHERE user_id = 1;
# But audit log still shows original amount → tamper detected

A - Availability

Definition: Authorized users dapat akses data/functionality ketika dibutuhkan.

Example: Payment API
- If API down 24/7, availability = 0%
- Protection: Redundancy, load balancing, DDoS mitigation, backups

How to Test:

# Test 1: Rate limiting present?
for i in {1..100}; do
  curl https://api.example.com/login &
done
wait
# After N requests, should return 429 Too Many Requests
# Not: 500 Internal Server Error

# Test 2: Is there failover?
# Primary server down → Secondary takes over
# Measure: Recovery Time Objective (RTO) & Recovery Point Objective (RPO)

# Test 3: Can service handle load?
ab -n 10000 -c 100 https://api.example.com/
# Should degrade gracefully (not crash)

Au - Authenticity

Definition: Verify bahwa data/user adalah genuine (bukan forgery atau impersonation).

Example: Message dari bank
- Attacker forge email: "Bank: Your account locked, click link"
- Authenticity protection: Digital signatures, SPF/DKIM/DMARC
- Verify: Sender adalah benar-benar bank, bukan attacker

How to Test:

# Test 1: Can user impersonate someone else?
curl -X POST https://api.example.com/send-message \
  -d '{"from": "admin", "to": "victim", "message": "..."}'
# Should verify "from" matches authenticated user

# Test 2: Are API requests signed?
# ✅ Good: Request signature validates sender authenticity
# ❌ Bad: Anyone dapat send request as anyone

# Test 3: Can attacker forge certificate?
openssl s_client -connect api.example.com:443
# Check certificate issuer (trusted CA, not self-signed)

NR - Non-Repudiation

Definition: User tidak dapat deny mereka melakukan sesuatu (evidence via audit trail).

Example: Online transaction
- User: "Saya tidak pernah transfer uang!"
- Non-Repudiation: Log shows: 
  User A IP:192.168.1.1 Transfer $1000 @2024-09-10 14:23:45 TZ=UTC
- Prove: Yes Anda did, di sini evidencenya

How to Test:

# Test 1: Is there audit log?
SELECT * FROM audit_log WHERE user_id = 123;
# Should show all actions: login, data access, modifications

# Test 2: Can logs be tampered?
# Logs stored READ-ONLY? Or in separate immutable database?
# ✅ Good: Logs in separate tamper-proof storage
# ❌ Bad: Logs dalam same database, dapat dihapus

# Test 3: Are logs digitally signed?
# ✅ Good: Each log entry signed dengan private key
# ❌ Bad: Anyone dapat modify logs

Translating CIA into Requirements

Ambil threat scenario, map ke CIA objective:

Scenario: Unauthorized credit card access

Threat: Attacker intercept payment data
↓
CIA Mapping:
- Confidentiality: Encrypt payment data (TLS, AES)
- Integrity: Validate no tampering (HMAC, signatures)
- Authenticity: Verify sender is real user (MFA)
- Non-Repudiation: Log all transactions

Scenario: Admin panel unauthorized access

Threat: Attacker access admin functions
↓
CIA Mapping:
- Authenticity: Strong admin authentication (MFA required)
- Availability: Admin panel available only to authorized
- Non-Repudiation: Log all admin actions
- Integrity: Prevent unauthorized modifications

Risk-Requirement Mapping Table

Trade-offs: CIA vs Usability

Security controls often conflict dengan usability:

More Confidentiality (encryption) → Slower performance
More Integrity (checksums everywhere) → More overhead
More Availability (redundancy) → Higher cost
More Authenticity (MFA) → Slower login

Your job: Balance security & usability.

# Example: MFA Trade-off
# ✅ SECURE: Require MFA for every login
# ❌ USABLE: Users frustrated, switch to competitor

# ✅ GOOD BALANCE: Require MFA for sensitive operations (transfer, password change)
#                  Remember trusted device option

Testing Checklist per CIA

Confidentiality Testing

• [ ] Sensitive data encrypted in transit (HTTPS)
• [ ] Sensitive data encrypted at rest (AES)
• [ ] No sensitive data in logs
• [ ] No sensitive data in error messages
• [ ] Unauthorized users cannot access data
• [ ] Cache headers prevent sensitive data caching

Integrity Testing

• [ ] Data cannot be modified by unauthorized users
• [ ] Tampering is detectable (audit log)
• [ ] Client-side modifications cannot affect server state
• [ ] Database changes are logged

Availability Testing

• [ ] Service handles load (load test)
• [ ] Failover works (primary down → secondary works)
• [ ] Rate limiting prevents abuse
• [ ] DDoS mitigation present
• [ ] Backup & restore tested

Authenticity Testing

• [ ] Users cannot impersonate others
• [ ] API requests cannot be forged
• [ ] Certificates valid & from trusted CA
• [ ] No credential confusion (user X vs user Y)

Non-Repudiation Testing

• [ ] Audit logs present & complete
• [ ] Logs cannot be deleted (immutable)
• [ ] Logs digitally signed
• [ ] Timestamps accurate & cannot be modified

Kesimpulan

CIA Triad + Authenticity + Non-Repudiation adalah universal security framework. Setiap requirement dapat dimapped ke salah satu dari 5 objectives ini.

Modul berikutnya (#03) membahas HTTP protocol & request-response model sebagai foundation untuk understanding web vulnerabilities.

Referensi

• NIST: Cybersecurity Framework
• ISO 27001: Information Security Management
• OWASP: Authentication Cheat Sheet

Baca Berikutnya: #03 - Arsitektur Web & HTTP Request-Response Model