T0188 - Cross Site Request Forgery

M1720

Mitigation

Mitigation Implement regular patches and updates Regular patches and updates are necessary to improve the security, performance, and reliability of software and systems.

They include bug fixes, security updates, and performance improvements. Regular patches and updates also ensure compatibility with new technologies and can help maintain compliance with regulatory standards. Failure to install patches and updates can leave systems vulnerable to security threats, cause system failures or crashes, and limit the functionality of software and systems.

M1880

Mitigation

Mitigation Implement Anti-CSRF token Implementing anti-CSRF tokens, also known as CSRF tokens or synchronization tokens, can be an effective mitigation technique.

A unique token is generated for each user session and included in each form or request. The server verifies the presence and validity of the token in each incoming request, ensuring that it originated from the same user session and not from a malicious source.

M1881

Mitigation

Mitigation Enable SameSite cookies Same-Site cookies are designed to restrict the transmission of cookies to only the same origin (i.

e., the same domain and protocol) as the original website. This can help prevent CSRF attacks by ensuring that cookies are not sent to malicious websites.

M1882

Mitigation

Mitigation Implement Strict Referer Policy Implementing a strict Referer policy can help mitigate CSRF attacks.

The Referer header is sent by web browsers in HTTP requests and indicates the source of the request. By validating the Referer header on the server side and only allowing requests from trusted sources, CSRF attacks can be mitigated.

M1883

Mitigation

Mitigation Implement Web Application Firewall A web application firewall (WAF) is a security control that is designed to protect web applications from various types of cyber threats, such as web-based attacks, including Cross-Site Scripting (XSS), SQL Injection, Cross-Site Request Forgery (CSRF), and other application-layer attacks.

A WAF acts as a filter between a web application and the incoming requests from clients, such as web browsers or mobile apps. It examines the incoming requests and responses to and from the web application, and applies a set of predefined security rules to identify and block malicious requests or traffic.

D1261

Detection

Detection Implement penetration testing Penetration testing, also known as ethical hacking or vulnerability assessment, is a proactive approach to mitigating cybersecurity risks.

It involves simulating real-world cyber attacks on a system, network, or application in a controlled and authorized manner to identify vulnerabilities and weaknesses that could be exploited by malicious actors.

D1262

Detection

Detection Implement vulnerability assesment Vulnerability assessment is a proactive approach to mitigating cybersecurity risks by systematically identifying, evaluating, and prioritizing vulnerabilities in a system, network, or application.

It involves conducting regular assessments to identify potential weaknesses that could be exploited by attackers, and taking appropriate actions to remediate or mitigate those vulnerabilities.

D1171

Detection

Mitigation Implement Web Application Firewall A web application firewall (WAF) is a security control that is designed to protect web applications from various types of cyber threats, such as web-based attacks, including Cross-Site Scripting (XSS), SQL Injection, Cross-Site Request Forgery (CSRF), and other application-layer attacks.

A WAF acts as a filter between a web application and the incoming requests from clients, such as web browsers or mobile apps. It examines the incoming requests and responses to and from the web application, and applies a set of predefined security rules to identify and block malicious requests or traffic.

D1880

Detection

Detection Missing Anti-CSRF token If your web application implements anti-CSRF tokens, validate the presence and correctness of the token in each incoming request.

If the token is missing or does not match the expected value, it could indicate a CSRF attack.

D1881

Detection

Detection Missing Referer header Check the Referer header in incoming HTTP requests to ensure that they match the expected source of the request.

If the Referer header is missing or does not match the expected source, it could indicate a potential CSRF attack. However, note that the Referer header can be easily spoofed or omitted by some browsers, so this technique may not be foolproof.