Requesting Clarifying Definition in the Business Logic Section Header

[craig-shony]

I think Section 11: Business Logic could use a basic definition. I'll include a first iteration-
In the context of application security, business logic refers to how security controls protect business rules from being bypassed or abused

[jmanico]

Good idea. Here is my first cut of a definition:

Business logic in application security refers to the customized rules and processes that safeguard an application in accordance with its specific requirements or the needs of the business it serves. These rules dictate various aspects such as user interactions, data handling, and system behavior, tailored to suit the unique characteristics of each application, business, or industry.

Some examples of business logic vulnerabilities:

Business Rule: Products should only be provided to customers after their transactions are successfully verified to prevent loss due to fraud or non-payment.
Vulnerability: If an attacker can manipulate the application to deliver a product before the purchase is verified, there's a risk of providing goods without receiving payment, leading to financial losses for the business.

Business Rule: High-value transactions above a certain threshold should be manually reviewed to ensure accuracy, legitimacy, and compliance with business policies.
Vulnerability: If an attacker can manipulate the application to skip the review process for high-value transactions, then fraudulent or erroneous transactions may go unnoticed, increasing the risk of financial losses or compliance violations.

[elarlang]

There are some things to keep in mind:

• We have a goal to reduce chapter texts as much as possible
  • See https://github.com/OWASP/ASVS/wiki/Roadmap-to-version-5.0#streamlined-document
• The same style must be through the document. If one paragraph contains some extra and educative text, it is expected from other paragraphs as well.

For all extra texts there must exist clear goals - why it exists, what (potential) confusion it eliminates, or what (potential) problem it solves.

[tghosth]

@elarlang I believe the added text makes sense and is not too long, I agree that before the draft we will need to decide how much text we want there and ensure there is consistency