# Control Security Modeling Analysis Method

## Core Formula

Missing Control Vulnerability = Sensitive Operation - Expected Control OR Sensitive Operation + Control Failure Bypass

Sensitive operation exists but expected security control is missing = Vulnerability

Mechanism defect leading to control bypass = Vulnerability

## Security Control Modeling & Control Existence/Effectiveness Validation

### Sensitive Operation Classification

| Category         | Identification Features                             | Typical Examples              | Risk Level |
| ------------ | ------------------------------------ | --------------------- | -------- |
| **Data Modification** | POST/PUT/DELETE                      | Create/Modify/Delete        | High       |
| **Data Access** | GET + ID parameter                         | /user/{id}  | Medium       |
| **Batch Operations** | export/download/batch  | Export/Batch delete         | High       |
| **Permission Changes** | role/permission/grant  | Role/Permission assignment         | Critical     |
| **Financial Operations** | transfer/pay/refund   | Transfer/Payment/Refund        | Critical     |
| **Authentication Operations** | login/password/token  | Login/Password reset         | Critical     |

### Security Control Matrix

| Sensitive Operation Type | Required Controls                         | Optional Controls |
| ------------ | -------------------------------- | -------- |
| **Data Modification** | Authentication, Authorization, Resource Ownership, Input Validation | Audit Log |
| **Data Access** | Authentication, Resource Ownership/Scope Restriction | Data Masking |
| **Batch Operations** | Authentication, Authorization, Quantity Limit | Rate Limiting |
| **Permission Changes** | Authentication, Elevated Authorization, Permission Boundary Check | Approval Process |
| **Financial Operations** | Authentication, Authorization, Idempotency, Concurrency Control | Risk Control Check |
| **Authentication Operations** | Idempotency, Rate Limiting | Concurrency Control |

### Missing Control -> Vulnerability Mapping

| Missing Control       | Vulnerability Type       | CWE     |
| -------------- | -------------- | ------- |
| Missing Authentication | Authentication Bypass | CWE-306 |
| Missing Authorization | Function-Level Authorization Missing | CWE-862 |
| Missing Resource Ownership | IDOR | CWE-639 |
| Authorization Logic Error | Authorization Error | CWE-863 |
| Missing Idempotency | Replay Attack | CWE-294 |
| Missing Concurrency Control | Race Condition | CWE-362 |
| Missing Rate Limiting | Brute Force, Flood Attack |  ... |

### Control Mechanism Defect -> Mechanism Bypass

- **Verification code state not invalidated**: After successful verification code validation, investigate whether there is a state control oversight where the code was not removed from cache or marked as invalid (leading to the same verification code being reused multiple times).
- **Input not bound**: In sensitive operation secondary authentication (such as financial transfers, password changes, etc.), review whether the target phone number/email completely trusts frontend-passed parameters without binding to the current logged-in user session identity (leading to secondary authentication failure).
- **Authentication step bypass**: Review multi-step operations (such as password recovery flow: 1. Verify phone -> 2. Enter verification code -> 3. Reset password) where critical steps rely solely on frontend-passed parameters (e.g., `step=3`) to determine the execution flow, without strong backend validation that the user has completed the preceding steps (logic jump vulnerability).
- **Validation returns without blocking**: In branches where authentication fails or the token is invalid, check if the code only logs, outputs error messages, or reassigns to create a token/session, but **does not write `return` or `raise` to completely block the execution flow**, causing subsequent sensitive code to continue executing (short-circuit defect).


## Notes

! For authentication and authorization issues, pay attention to cross-referencing other method implementations in the same module.
! Be careful to analyze whether control mechanisms have logic defects that could allow the mechanism to be bypassed.
