Skip to content

Hide Navigation Hide TOC

Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1)

Application Developer Guidance focuses on providing developers with the knowledge, tools, and best practices needed to write secure code, reduce vulnerabilities, and implement secure design principles. By integrating security throughout the software development lifecycle (SDLC), this mitigation aims to prevent the introduction of exploitable weaknesses in applications, systems, and APIs. This mitigation can be implemented through the following measures:

Preventing SQL Injection (Secure Coding Practice):

  • Implementation: Train developers to use parameterized queries or prepared statements instead of directly embedding user input into SQL queries.
  • Use Case: A web application accepts user input to search a database. By sanitizing and validating user inputs, developers can prevent attackers from injecting malicious SQL commands.

Cross-Site Scripting (XSS) Mitigation:

  • Implementation: Require developers to implement output encoding for all user-generated content displayed on a web page.
  • Use Case: An e-commerce site allows users to leave product reviews. Properly encoding and escaping user inputs prevents malicious scripts from being executed in other users’ browsers.

Secure API Design:

  • Implementation: Train developers to authenticate all API endpoints and avoid exposing sensitive information in API responses.
  • Use Case: A mobile banking application uses APIs for account management. By enforcing token-based authentication for every API call, developers reduce the risk of unauthorized access.

Static Code Analysis in the Build Pipeline:

  • Implementation: Incorporate tools into CI/CD pipelines to automatically scan for vulnerabilities during the build process.
  • Use Case: A fintech company integrates static analysis tools to detect hardcoded credentials in their source code before deployment.

Threat Modeling in the Design Phase:

  • Implementation: Use frameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design.
  • Use Case: Before launching a customer portal, a SaaS company identifies potential abuse cases, such as session hijacking, and designs mitigations like secure session management.

Tools for Implementation:

  • Static Code Analysis Tools: Use tools that can scan for known vulnerabilities in source code.
  • Dynamic Application Security Testing (DAST): Use tools like Burp Suite or OWASP ZAP to simulate runtime attacks and identify vulnerabilities.
  • Secure Frameworks: Recommend secure-by-default frameworks (e.g., Django for Python, Spring Security for Java) that enforce security best practices.
Cluster A Galaxy A Cluster B Galaxy B Level
XPC Services - T1559.003 (8252f135-ed26-4ce1-ae61-f26e94429a19) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Supply Chain Compromise - T1474 (0d95940f-9583-4e0f-824c-a42c1be47fad) Attack Pattern 1
Inter-Process Communication - T1559 (acd0ba37-7ba9-4cc5-ac61-796586cd856d) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 1
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Application Access Token - T1550.001 (f005e783-57d4-4837-88ad-dbe7faee1c51) Attack Pattern 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Plist File Modification - T1647 (7d20fff9-8751-404e-badd-ccd71bda0236) Attack Pattern 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Search Open Websites/Domains - T1593 (a0e6614a-7740-4b24-bd65-f1bde09fc365) Attack Pattern 1
Screen Capture - T1513 (73c26732-6422-4081-8b63-6d0ae93d449e) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
File/Path Exclusions - T1564.012 (09b008a9-b4eb-462a-a751-a0eb58050cd9) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Resource Forking - T1564.009 (b22e5153-ac28-4cc6-865c-2054e36285cb) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Supply Chain Compromise - T1195 (3f18edba-28f4-4bb9-82c3-8aa60dcac5f7) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Abuse Elevation Control Mechanism - T1626 (08ea902d-ecb5-47ed-a453-2798057bb2d3) Attack Pattern 1
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action URI Hijacking - T1635.001 (789ef15a-34d9-4b32-a779-8cbbc9eb32f5) Attack Pattern 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Exploitation for Credential Access - T1212 (9c306d8d-cde7-4b4c-b6e8-d0bb16caca36) Attack Pattern 1
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Steal Application Access Token - T1635 (233fe2c0-cb41-4765-b454-e0087597fbce) Attack Pattern 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Code Repositories - T1593.003 (70910fbd-58dc-4c1c-8c48-814d11fcd022) Attack Pattern 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Access Notifications - T1517 (39dd7871-f59b-495f-a9a5-3cb8cc50c9b2) Attack Pattern 1
Compromise Software Dependencies and Development Tools - T1195.001 (191cc6af-1bb2-4344-ab5f-28e496638720) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action Compromise Software Dependencies and Development Tools - T1474.001 (7827ced0-95e7-4d05-bdcf-0d8f2d37a3d3) Attack Pattern 1
SMS Pumping - T1496.003 (130d4494-b2d6-4040-bcea-6e59f05222fe) Attack Pattern Application Developer Guidance - M1013 (25dc1ce8-eb55-4333-ae30-a7cb4f5894a1) Course of Action 1
Inter-Process Communication - T1559 (acd0ba37-7ba9-4cc5-ac61-796586cd856d) Attack Pattern XPC Services - T1559.003 (8252f135-ed26-4ce1-ae61-f26e94429a19) Attack Pattern 2
Hijack Execution Flow - T1574 (aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6) Attack Pattern DLL - T1574.001 (2fee9321-3e71-4cf4-af24-d4d40d355b34) Attack Pattern 2
Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814) Attack Pattern Application Access Token - T1550.001 (f005e783-57d4-4837-88ad-dbe7faee1c51) Attack Pattern 2
Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern File/Path Exclusions - T1564.012 (09b008a9-b4eb-462a-a751-a0eb58050cd9) Attack Pattern 2
Resource Forking - T1564.009 (b22e5153-ac28-4cc6-865c-2054e36285cb) Attack Pattern Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern 2
Steal Application Access Token - T1635 (233fe2c0-cb41-4765-b454-e0087597fbce) Attack Pattern URI Hijacking - T1635.001 (789ef15a-34d9-4b32-a779-8cbbc9eb32f5) Attack Pattern 2
Code Repositories - T1593.003 (70910fbd-58dc-4c1c-8c48-814d11fcd022) Attack Pattern Search Open Websites/Domains - T1593 (a0e6614a-7740-4b24-bd65-f1bde09fc365) Attack Pattern 2
Compromise Software Dependencies and Development Tools - T1195.001 (191cc6af-1bb2-4344-ab5f-28e496638720) Attack Pattern Supply Chain Compromise - T1195 (3f18edba-28f4-4bb9-82c3-8aa60dcac5f7) Attack Pattern 2
Compromise Software Dependencies and Development Tools - T1474.001 (7827ced0-95e7-4d05-bdcf-0d8f2d37a3d3) Attack Pattern Supply Chain Compromise - T1474 (0d95940f-9583-4e0f-824c-a42c1be47fad) Attack Pattern 2
SMS Pumping - T1496.003 (130d4494-b2d6-4040-bcea-6e59f05222fe) Attack Pattern Resource Hijacking - T1496 (cd25c1b4-935c-4f0e-ba8d-552f28bc4783) Attack Pattern 2