{"text_format":"3","workbook":"xls","n_sheets":2,"sheets":["Web application checklist","Notes"],"not_rendered":{"images":1,"external_links":1,"defined_names":1},"read":"whole","date_system":"1900","formulas":"cached_only"}

{"sheet":"Web application checklist","index":0,"n_rows":57,"n_cols":6,"rows_kept":57,"flags":["formulas_cached_only"]}
["PROJECT:"]
["Information Security - technical checklist - controls for web applications"]
[null,null,"R","A","G","Notes"]
[]
["Administration"]
[1.1,"Appropriate user and password procedures are in place for Helpdesk ","R"]
[1.2,"The system does not allow for password retrieval (i.e., passwords have to be reset)",null,"A"]
[1.3,"The system require some form of verification before resetting a password ",null,null,"G"]
[1.4,"Users are educated on how to protect their account information "]
[1.5,"Navigation around the application is easy"]
[1.6,"Source code do not reveal inappropriate information "]
[1.7,"Adequate system documentation around authentication, authorisation and auditing are in place "]
["Authentication – “who can get in?”"]
[2.1,"The system requires both a username and password"]
[2.2,"The system allows for, encourage, or enforce strong passwords (e.g., minimum 6-8 characters)"]
[2.3,"The system allows for password aging and enforce a password history (e.g., change every 30-90 days, history of 12) "]
[2.4,"The system does not permit easily-guessed usernames and passwords (e.g., password cannot equal user id) "]
[2.5,"The system does not allow the harvesting of usernames through the application "]
[2.6,"Error messages do not provide too much information about usernames or passwords"]
[2.7,"The system does not provide the last username that logged on, i.e., the user has to re-type username "]
[2.8,"Controls exists to prevent brute-force guessing of usernames or password "]
[2.9,"The source code does not contain any hard-coded username or password checks"]
["2.10","Users cannot change their username"]
[2.11,"Users can easily change their own passwords  "]
[2.12,"Users required to re-authenticate before changing a password"]
[2.13,"The system assigns temporary initial passwords that are unique and not easy to guess  "]
[2.14,"There is no sharing of administrative user accounts and passwords  "]
[2.15,"There is no sharing of other accounts and passwords  "]
[2.16,"The system transmits user credentials over a secure channel"]
[2.17,"Passwords are stored using a strong hashing algorithm"]
[2.18,"Users cannot bypass authentication by accessing a module directly"]
[2.19,"The system does not allow authentication to the Web server's operating system or network"]
["2.20","The system prevent account hopping (e.g., via URL)"]
[2.21,"A third party cannot trick users into authenticating to fake login pages"]
[2.22,"Users cannot customise their security options"]
[2.23,"Users cannot revoke or delete accounts"]
[2.24,"A hijacked cookie will not allow a user logon "]
[2.25,"Sensitive information such as passwords is not stored in cookies"]
[2.26,"Cookies have a reasonable expiration date"]
[2.27,"Input field validation checks have been built in  "]
["Authorisation – “what can they do?”"]
[3.1,"Users have the option to log out of their session in a controlled manner  "]
[3.2,"The system destroy session tokens upon logging out or timing out"]
[3.3,"Session expiration mechanisms are in place  "]
[3.4,"Users are grouped and have specific and restricted rights, privileges"]
[3.5,"Users, assignment of groups and their roles have been formally documented and approved  "]
[3.6,"There are restrictions to the “back” and “forward” web buttons"]
[3.7,"The “right click” functionality of the web browser is disabled"]
["Auditing – “what have they done?”"]
[4.1,"Users get to see their account history  "]
[4.2,"Users can easily report security incidents  "]
[4.3,"All user activity is logged"]
[4.4,"All key changes to system parameters and users are logged"]
[4.5,"The above key changes and any unusual events are reviewed and followed up  "]
["Availability"]
[5.1,"Number of concurrent logins is restricted  "]
[5.2,"Reports, queries or processes are properly queued and prioritised and assigned appropriate resources  "]

{"sheet":"Notes","index":1,"n_rows":7,"n_cols":1,"rows_kept":7,"flags":["formulas_cached_only"]}
["Notes:"]
[]
[]
[1]
[2]
[3]
[4]