OWASP #4: Insecure Design - Quick Reference

📋 What Is It?

Insecure Design represents missing or ineffective security controls in the design and architecture phase. These are fundamental flaws that no amount of perfect implementation can fix. Security must be designed in from the start, not added later.

#4 OWASP Rank

NEW 2021 Addition

40+ CWE Mappings

⚠️ Common Exploits

Unlimited Brute Force: No rate limiting on authentication
Business Logic Bypass: Missing validation of workflows
Missing Controls: No authentication/authorization requirements
No Segregation of Duties: Single user can complete critical operations
Missing Security Requirements: Security not part of design specs

🔴 Attack Flow

1. App designed without rate limiting
↓
2. Attacker targets login endpoint
↓
3. Tries thousands of passwords per second
↓
4. No protection mechanisms exist
↓
5. BREACH: Account compromised!

❌ Vulnerable Code

// Bad: No rate limiting on login
@app.route('/login', methods=['POST'])
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    
    # Unlimited attempts - brute force possible!
    if check_credentials(username, password):
        return success_response()
    return error_response()

// Bad: No account lockout mechanism
// Bad: No CAPTCHA after failures
// Bad: No delay between attempts
                

✅ Secure Code

// Good: Rate limiting implemented
from flask_limiter import Limiter

limiter = Limiter(app, key_func=get_remote_address)

@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
def login():
    username = request.form.get('username')
    password = request.form.get('password')
    
    # Check failed attempts
    if is_account_locked(username):
        return error_response("Account locked"), 403
    
    if check_credentials(username, password):
        reset_failed_attempts(username)
        return success_response()
    
    increment_failed_attempts(username)
    return error_response("Invalid credentials"), 401
                

✓ Prevention Checklist

Implement threat modeling during design
Define security requirements upfront
Use secure design patterns (deny by default)
Implement defense in depth
Add rate limiting to sensitive operations
Conduct architecture security reviews
Implement account lockout mechanisms
Design with segregation of duties
Use secure by default configurations
Document security decisions

🔍 Detection & Tools

Design Tools:

Threat Dragon Microsoft TMT STRIDE PASTA

Prevention Libraries:

Flask-Limiter Django Axes Express Rate Limit Throttle

How to Test:

Review architecture diagrams for missing controls
Test rate limits on all endpoints
Verify business logic flows
Check for segregation of duties

🌍 Real-World Examples

E-commerce sites: No rate limiting allows automated inventory hoarding during sales
Banking apps: Missing transaction limits enable large fraudulent transfers
Ticket platforms: No anti-bot measures allow scalper bots to buy all inventory
Voting systems: Lack of segregation allows single admin to manipulate results

📌 Quick Tips

DO NOT assume security can be added later
DO NOT skip threat modeling phase
DO define security requirements early
DO implement rate limiting everywhere
DO use secure design patterns

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.5
NIST 800-53 SA-8, SA-15
ISO 27001 A.14.2
CWE CWE-841, CWE-1127

📐 Insecure Design