## 6 Validation within an Industrial Setting
### Implementation of the Controls  
Upon completion of the security control selection process, the next task was to implement the controls. The developer needed to follow the implementation details outlined in Appendix B for each control. The examples below illustrate the implementation details for one vulnerability from Table 3.  
Vulnerability name: Weak authentication scheme  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vulnerabilities** & **Description** \\ \hline The device data store could be corrupted & Data flowing across iOS\_to\_S\_Response may be tampered with by an attacker. This may lead to corruption of device. Ensure the integrity of the data flow to the data store. \\ \hline Potential weak protections & Consider what happens when the audit mechanism comes under attack, including attempts to destroy the logs. Ensure access to the log is through channels which control read and write separately. \\ \hline Potential data repudiation & REST API claims that it did not receive data from a source outside the trust boundary. Consider using logging or auditing to record the source, time, and summary of the received data. \\ \hline Weak authentication scheme & Custom authentication schemes are susceptible to common weaknesses such as weak credential change management, credentials and a weak credential change management system. \\ \hline Potential lack of input & Data flowing across Android\_to\_API\_Request may be tampered with by an attacker. This may lead to a denial of service (DoS) attack against REST API or an elevation of privilege attack against REST API or an information disclosure by REST API. \\ \hline \hline \end{tabular}
\end{table}
Table 2: Sample vulnerabilities identified using Microsoft TMT tool.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vulnerabilities** & **Control** \\ \hline Weak authentication scheme & Authentication \\ \hline Weak credential transit & Authentication, Encryption \\ \hline Potential data repudiation by Android and/or  iOS application & Auditing, Non-repudiation \\ \hline Potential process crash or stop for REST API & Access control, Intrusion detection, Auditing \\ \hline Lack of data input validation & Data integrity, Input validation \\ \hline Lack of encryption on transmitted data & Encryption, Communication security \\ \hline Lack of encryption on private/sensitive data & Encryption \\  at rest & \\ \hline Lack of physical tamper detection and & Physical protection \\  response & Access control \\ \hline Weak remote access controls & Access control \\ \hline Lack of system hardening & Physical protection, Client platform security \\ \hline \hline \end{tabular}
\end{table}
Table 3: Mapping of the control for respective vulnerabilities.  
Security control: Authentication Implementation details:
* Force users to have a strong password.
* Do not display or transmit the password in clear text. Validate the email address and password through an input validation technique. Validate email address by sending an email verification link.
* Lock user accounts after a certain number of failed logins attempts during a time-period.
* Maintain a list of commonly used, expected, or compromised passwords and update the list when passwords are compromised directly or indirectly.