jperezduerto.info
Security in depth · Unit 28 · Lesson 8 of 11
Name the rules that must always hold
Attach a security rule to the protected state, including revisions and background work.
Helpful before thisThreat modeling: ask before building
After this lesson you can
- Define a revision-specific approval invariant and identify the transition that violates it.
Approval of yesterday's text should not silently approve today's revision.
A rule about state
A security invariant is a property that must remain true across the relevant allowed states and transitions. Make it precise enough to judge: who may do what, to which object, under which condition?
For publication, “approval required” may be incomplete. Approval can belong to a particular revision, so an edit changes the thing being approved. The invariant must survive background processing, retries, and administrative actions that reach the same protected state.
Supplied record: the neighborhood noticeboard
The fictional editor requires approval of the exact text before publication. Its design review records:
R7: reviewed and approved.
R8: edited after that approval; no approval recorded.
Web publication action: refuses R8 without its approval.
Scheduled publication worker: marks R8 published using the notice’s earlier approval flag.
Assume these are accurate state records and no exception is approved. R8’s publication violates the stated property. The successful web check remains useful, but cannot establish that the complete workflow preserves the invariant.
Write the invariant and acceptance cases
State: “A revision may enter the published state only with valid approval for that revision.” Ask the designer to identify the trusted decision point for every publication transition.
Your acceptance table should cover an approved revision, an edited revision awaiting approval, and the scheduled worker processing each. An audit trail should connect the published revision to the relevant approval rather than merely recording that someone clicked an approval button sometime.
This property does not guarantee factual accuracy of approved text. Enforcing the invariant preserves a defined relationship between review evidence and publication state.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Which requirement would address the gap in the notice record?
Show the answer
Correct answer: Every publication transition must confirm approval for the exact revision being published. R7 approval does not approve R8. The rule belongs to the publication state change across both interactive and background paths.
Try it
- WriteWrite one invariant for notice publication and a transition table covering the web action, scheduled worker, and later edits. Include expected treatment of a new revision without approval.