M3—Insecure Authentication/Authorization

>Control Description

**Application Specific** Threat agents that exploit authentication and authorization vulnerabilities typically do so through automated attacks that use available or custom-built tools.

>Prevention & Mitigation Strategies

1.Perform all authentication requests server-side; ensure mobile authentication requirements match those of the web application counterpart.
2.Never store user passwords on the device; use device-specific, revocable authentication tokens instead.
3.Implement strong authentication protocols and avoid weak 4-digit PINs; use multi-factor authentication where possible.
4.Backend systems must independently verify authenticated user roles and permissions; never rely on role or permission data transmitted from the mobile device.
5.Use FaceID/TouchID to unlock biometrically locked secrets and protect sensitive authentication materials like session tokens.
6.Implement local integrity checks to detect unauthorized code changes when offline authentication is required.

>Attack Scenarios

>References

Ask AI

Configure your API key to use AI features.