diff --git a/mappings/remediation_advice/remediation_advice.json b/mappings/remediation_advice/remediation_advice.json index f0e048b9..4e391312 100644 --- a/mappings/remediation_advice/remediation_advice.json +++ b/mappings/remediation_advice/remediation_advice.json @@ -1014,14 +1014,14 @@ "children": [ { "id": "weak_password_policy", - "remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n2. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n3. Allow for a large maximum password length.\n4. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n5. Disallow previous passwords from being used.\n6. Disallow the password being the same as the email or username.", + "remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n3. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n4. Allow for a large maximum password length.\n5. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n6. Disallow previous passwords from being used.\n7. Disallow the password being the same as the email or username.", "references": [ "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md#implement-proper-password-strength-controls" ] }, { "id": "no_password_policy", - "remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n2. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n3. Allow for a large maximum password length.\n4. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n5. Disallow previous passwords from being used.\n6. Disallow the password being the same as the email or username.", + "remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n3. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n4. Allow for a large maximum password length.\n5. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n6. Disallow previous passwords from being used.\n7. Disallow the password being the same as the email or username.", "references": [ "https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md#implement-proper-password-strength-controls" ] @@ -1240,7 +1240,7 @@ }, { "id": "clipboard_enabled", - "remediation_advice": "Ensure that copy/paste functionality is disabled on sensitive content like credit card numbers, social security numbers etc. as other apps on the same device can access data stored in clipboard.\nThe example below disables clipboard for the `textField` TextView in Android:\n```java\ntextField.setCustomSelectionActionModeCallback(new ActionMode.Callback() {\n public boolean onCreateActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onPrepareActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onActionItemClicked(ActionMode actionMode, MenuItem item) {\n return false;\n }\n\n public void onDestroyActionMode(ActionMode actionMode) {\n }\n});\ntextField.setLongClickable(false);\ntextField.setTextIsSelectable(false);\n```\nThe example below disables clipboard for UITextField in iOS:\n```swift\noverride public func canPerformAction(_ action: Selector, withSender sender: Any?) -> Bool {\n if action == #selector(copy(_:)) || action == #selector(paste(_:)) {\n return false\n }\n return true\n}\n```" + "remediation_advice": "Ensure that copy/paste functionality is disabled on sensitive content like credit card numbers, social security numbers etc. as other apps on the same device can access data stored in clipboard.\nThe example below disables clipboard for the `textField` TextView in Android:\n\n```java\ntextField.setCustomSelectionActionModeCallback(new ActionMode.Callback() {\n public boolean onCreateActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onPrepareActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onActionItemClicked(ActionMode actionMode, MenuItem item) {\n return false;\n }\n\n public void onDestroyActionMode(ActionMode actionMode) {\n }\n});\ntextField.setLongClickable(false);\ntextField.setTextIsSelectable(false);\n```\n\nThe example below disables clipboard for UITextField in iOS:\n\n```swift\noverride public func canPerformAction(_ action: Selector, withSender sender: Any?) -> Bool {\n if action == #selector(copy(_:)) || action == #selector(paste(_:)) {\n return false\n }\n return true\n}\n```\n\n" }, { "id": "auto_backup_allowed_by_default",