A sensitive business flow is a business process that a threat actor can exploit for personal benefit while harming the organization operating it. Examples include referrals, purchases, ticket sales, bookings, reviews, and scraping. section 4.9
Referral rewards and fake accounts
A referral program rewards User A when User B joins. If the API does not verify User B’s account authenticity, User A can create unlimited fake accounts and collect endless rewards. Similar unrestricted flows enable scalping bots to poll availability and buy an entire stock when products or tickets appear. section 4.9
Assess and constrain sensitive flows by:
- Modeling the business harm alongside the technical attack, including poor customer experience and API performance impact from automated polling. section 4.9
- Using CAPTCHA challenges for web applications and measuring time intervals between multistep actions to identify automated scripts. section 4.9
- Testing complex operations with assertions about the resulting resource state, rather than checking only individual requests. section 12.1
